This is an automated email from the ASF dual-hosted git repository.
pierrejeambrun pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 468bfe339ed Update run-behind-proxy doc for CSP (#50236)
468bfe339ed is described below
commit 468bfe339ed3d5053db2a9776b6f9bbf4f7a04de
Author: Pierre Jeambrun <[email protected]>
AuthorDate: Tue May 6 15:26:17 2025 +0200
Update run-behind-proxy doc for CSP (#50236)
* Update run-behind-proxy doc for CSP
* Update airflow-core/docs/howto/run-behind-proxy.rst
---------
Co-authored-by: Kaxil Naik <[email protected]>
---
airflow-core/docs/howto/run-behind-proxy.rst | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/airflow-core/docs/howto/run-behind-proxy.rst
b/airflow-core/docs/howto/run-behind-proxy.rst
index 294823753a5..c9eb3295bd2 100644
--- a/airflow-core/docs/howto/run-behind-proxy.rst
+++ b/airflow-core/docs/howto/run-behind-proxy.rst
@@ -51,6 +51,11 @@ To do so, you need to set the following setting in your
``airflow.cfg``::
}
}
+- Some parts of the UI are rendered inside iframes (Auth managers security
links for instance), you need to make sure that you are not setting a
restricted CSP for iframe rendering
+ such as ``frame-ancestors 'none'``. You can set the CSP header in your
reverse proxy configuration, for example::
+
+ add_header Content-Security-Policy "frame-ancestors 'self';";
+
- Use ``--proxy-headers`` CLI flag to tell Uvicorn to respect these headers:
``airflow api-server --proxy-headers``
- If your proxy server is not on the same host (or in the same docker
container) as Airflow, then you will need to
