[
https://issues.apache.org/jira/browse/AIRFLOW-2886?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17242429#comment-17242429
]
ASF subversion and git services commented on AIRFLOW-2886:
----------------------------------------------------------
Commit 653104aee85136178a7c7a0e5841b17fd0ebd4d3 in airflow's branch
refs/heads/v1-10-test from Kaxil Naik
[ https://gitbox.apache.org/repos/asf?p=airflow.git;h=653104a ]
fixup! [AIRFLOW-2886] Generate random Flask SECRET_KEY in default config (#3738)
> Secure Flask SECRET_KEY
> -----------------------
>
> Key: AIRFLOW-2886
> URL: https://issues.apache.org/jira/browse/AIRFLOW-2886
> Project: Apache Airflow
> Issue Type: Bug
> Reporter: Xiaodong Deng
> Assignee: Xiaodong Deng
> Priority: Critical
> Fix For: 2.0.0
>
>
> In my earlier PRs, [https://github.com/apache/incubator-airflow/pull/3651]
> and [https://github.com/apache/incubator-airflow/pull/3729] , I proposed to
> generate random SECRET_KEY for Flask App.
> If we have multiple workers for the Flask webserver, we may encounter CSRF
> error {{The CSRF session token is missing}} .
> On the other hand, it's still very important to have as random SECRET_KEY as
> possible for security reasons. We can deal with it like how we dealt with
> FERNET_KEY (i.e. generate a random value when the airflow.cfg file is
> initiated).
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
