This is an automated email from the ASF dual-hosted git repository.
kaxilnaik pushed a commit to branch v3-0-test
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/v3-0-test by this push:
new 55ee1da8785 [v3-0-test] Update run-behind-proxy doc for CSP (#50236)
(#50241)
55ee1da8785 is described below
commit 55ee1da8785ca357a408165a207c28f51a00be81
Author: github-actions[bot]
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Tue May 6 18:59:23 2025 +0530
[v3-0-test] Update run-behind-proxy doc for CSP (#50236) (#50241)
* Update run-behind-proxy doc for CSP
* Update airflow-core/docs/howto/run-behind-proxy.rst
---------
(cherry picked from commit 468bfe339ed3d5053db2a9776b6f9bbf4f7a04de)
Co-authored-by: Pierre Jeambrun <[email protected]>
Co-authored-by: Kaxil Naik <[email protected]>
---
airflow-core/docs/howto/run-behind-proxy.rst | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/airflow-core/docs/howto/run-behind-proxy.rst
b/airflow-core/docs/howto/run-behind-proxy.rst
index 294823753a5..c9eb3295bd2 100644
--- a/airflow-core/docs/howto/run-behind-proxy.rst
+++ b/airflow-core/docs/howto/run-behind-proxy.rst
@@ -51,6 +51,11 @@ To do so, you need to set the following setting in your
``airflow.cfg``::
}
}
+- Some parts of the UI are rendered inside iframes (Auth managers security
links for instance), you need to make sure that you are not setting a
restricted CSP for iframe rendering
+ such as ``frame-ancestors 'none'``. You can set the CSP header in your
reverse proxy configuration, for example::
+
+ add_header Content-Security-Policy "frame-ancestors 'self';";
+
- Use ``--proxy-headers`` CLI flag to tell Uvicorn to respect these headers:
``airflow api-server --proxy-headers``
- If your proxy server is not on the same host (or in the same docker
container) as Airflow, then you will need to
