pierrejeambrun commented on issue #47878:
URL: https://github.com/apache/airflow/issues/47878#issuecomment-4798503279
Update:
The fixed pattern (proxy-aware) is:
`secure = request.base_url.scheme == "https" or bool(conf.get("api",
"ssl_cert", fallback=""))`
request.base_url.scheme resolves to https behind a TLS-terminating proxy
because gunicorn is
started with forwarded_allow_ips="*" when proxy_headers is on
(gunicorn_app.py:290). So where
this is used, the issue is addressed.
✅ Done (request-scheme-aware):
- airflow-core — simple/routes/login.py:96,
auth/middlewares/refresh_token.py:72,
core_api/routes/public/auth.py:71
- FAB — fab/auth_manager/api_fastapi/routes/login.py:106 and the legacy
Flask
fab/www/views.py:122
- Keycloak — only logout_callback (the cookie delete, line 158)
❌ Not done (still secure = bool(conf.get("api","ssl_cert")), cert-only):
- Keycloak login → _oauth_state cookie (routes/login.py:68)
- Keycloak login_callback → the actual session cookies, JWT + _id_token
(routes/login.py:108)
- AWS login_callback → JWT cookie (aws/auth_manager/routes/login.py:121)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
