mik-laj commented on code in PR #24519:
URL: https://github.com/apache/airflow/pull/24519#discussion_r900790476
##########
airflow/utils/serve_logs.py:
##########
@@ -16,55 +16,87 @@
# under the License.
"""Serve logs process"""
+import logging
import os
-import time
import gunicorn.app.base
from flask import Flask, abort, request, send_from_directory
-from itsdangerous import TimedJSONWebSignatureSerializer
+from jwt.exceptions import (
+ ExpiredSignatureError,
+ ImmatureSignatureError,
+ InvalidAudienceError,
+ InvalidIssuedAtError,
+ InvalidSignatureError,
+)
from setproctitle import setproctitle
from airflow.configuration import conf
+from airflow.utils.docs import get_docs_url
+from airflow.utils.jwt_signer import JWTSigner
+
+logger = logging.getLogger(__name__)
def create_app():
flask_app = Flask(__name__, static_folder=None)
- max_request_age = conf.getint('webserver', 'log_request_clock_grace',
fallback=30)
+ expiration_time_in_seconds = conf.getint('webserver',
'log_request_clock_grace', fallback=30)
log_directory = os.path.expanduser(conf.get('logging', 'BASE_LOG_FOLDER'))
- signer = TimedJSONWebSignatureSerializer(
+ signer = JWTSigner(
secret_key=conf.get('webserver', 'secret_key'),
- algorithm_name='HS512',
- expires_in=max_request_age,
- # This isn't really a "salt", more of a signing context
- salt='task-instance-logs',
+ expiration_time_in_seconds=expiration_time_in_seconds,
+ audience="task-instance-logs",
)
# Prevent direct access to the logs port
@flask_app.before_request
def validate_pre_signed_url():
try:
- auth = request.headers['Authorization']
-
- # We don't actually care about the payload, just that the signature
- # was valid and the `exp` claim is correct
- filename, headers = signer.loads(auth, return_header=True)
-
- issued_at = int(headers['iat'])
- expires_at = int(headers['exp'])
- except Exception:
+ auth = request.headers.get('Authorization')
+ if auth is None:
+ logger.warning(f"The Authorization header is missing:
{request.headers}")
+ abort(403)
+ payload = signer.verify_token(auth)
+ token_filename = payload.get("filename")
+ request_filename = request.view_args['filename']
+ if token_filename is None:
+ logger.warning("The payload does not contain 'filename' key:
%s.", payload)
+ abort(403)
+ if token_filename != request_filename:
+ logger.warning(
Review Comment:
F-strings in logger.
##########
airflow/utils/serve_logs.py:
##########
@@ -16,55 +16,87 @@
# under the License.
"""Serve logs process"""
+import logging
import os
-import time
import gunicorn.app.base
from flask import Flask, abort, request, send_from_directory
-from itsdangerous import TimedJSONWebSignatureSerializer
+from jwt.exceptions import (
+ ExpiredSignatureError,
+ ImmatureSignatureError,
+ InvalidAudienceError,
+ InvalidIssuedAtError,
+ InvalidSignatureError,
+)
from setproctitle import setproctitle
from airflow.configuration import conf
+from airflow.utils.docs import get_docs_url
+from airflow.utils.jwt_signer import JWTSigner
+
+logger = logging.getLogger(__name__)
def create_app():
flask_app = Flask(__name__, static_folder=None)
- max_request_age = conf.getint('webserver', 'log_request_clock_grace',
fallback=30)
+ expiration_time_in_seconds = conf.getint('webserver',
'log_request_clock_grace', fallback=30)
log_directory = os.path.expanduser(conf.get('logging', 'BASE_LOG_FOLDER'))
- signer = TimedJSONWebSignatureSerializer(
+ signer = JWTSigner(
secret_key=conf.get('webserver', 'secret_key'),
- algorithm_name='HS512',
- expires_in=max_request_age,
- # This isn't really a "salt", more of a signing context
- salt='task-instance-logs',
+ expiration_time_in_seconds=expiration_time_in_seconds,
+ audience="task-instance-logs",
)
# Prevent direct access to the logs port
@flask_app.before_request
def validate_pre_signed_url():
try:
- auth = request.headers['Authorization']
-
- # We don't actually care about the payload, just that the signature
- # was valid and the `exp` claim is correct
- filename, headers = signer.loads(auth, return_header=True)
-
- issued_at = int(headers['iat'])
- expires_at = int(headers['exp'])
- except Exception:
+ auth = request.headers.get('Authorization')
+ if auth is None:
+ logger.warning(f"The Authorization header is missing:
{request.headers}")
Review Comment:
F-strings in loggers.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscr...@airflow.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
