potiuk opened a new pull request, #65348:
URL: https://github.com/apache/airflow/pull/65348
## Summary
`JWTRefreshMiddleware` set the JWT refresh cookie's `Secure` flag based
solely on whether `api.ssl_cert` was configured locally. In deployments where
TLS is terminated at a reverse proxy and the Airflow process itself has no SSL
certificate, this evaluated to `False` and the cookie was sent without the
`Secure` flag even when the incoming request was already HTTPS.
Every other cookie-setting location in the codebase uses the same pattern:
```python
secure = request.base_url.scheme == "https" or bool(conf.get("api",
"ssl_cert", fallback=""))
```
…at `core_api/routes/public/auth.py:68`,
`auth/managers/simple/routes/login.py:92`, `providers/fab/.../login.py:106`,
`providers/keycloak/.../login.py:158`, and documented in
`auth-manager/index.rst:168`. This PR brings `JWTRefreshMiddleware` in line.
## Test plan
- [x] New parametrized test `test_dispatch_cookie_secure_flag` covers all 4
combinations of `scheme` × `ssl_cert` and asserts the `Secure` cookie attribute
is set exactly when it should be
- [x] Existing 7 tests in `test_refresh_token.py` continue to pass
- [x] Total: 11/11 pass
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Opus 4.6 (1M context)
Generated-by: Claude Opus 4.6 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
