srchilukoori opened a new pull request, #65735: URL: https://github.com/apache/airflow/pull/65735
## Summary Fixes #65728. Three `generate_password_hash(password)` calls in `FabAirflowSecurityManagerOverride` used werkzeug's default hashing method, ignoring `FAB_PASSWORD_HASH_METHOD` in the Flask app config. On FIPS-compliant systems (which ban MD5/SHA-1), werkzeug's default may produce incompatible hashes depending on the installed version, and operators cannot override it. Changes: - Adds `_hash_password(password)` helper that reads `FAB_PASSWORD_HASH_METHOD` from `current_app.config` (defaulting to `scrypt`) and passes it to `generate_password_hash` - Replaces 3 bare `generate_password_hash(password)` calls in `reset_password`, `add_user`, and `add_register_user` with `self._hash_password(password)` - Adds 4 tests covering the helper's config-forwarding behaviour and both callers ## Test plan - [x] `test_hash_password_uses_fab_password_hash_method` — helper forwards configured method - [x] `test_hash_password_defaults_to_scrypt_when_config_absent` — falls back to `scrypt` - [x] `test_reset_password_uses_configured_hash_method` — `reset_password` uses configured method - [x] `test_add_user_uses_configured_hash_method` — `add_user` uses configured method - [x] Full FAB provider test suite: **508 passed, 2 skipped** (no regressions) 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
