pierrejeambrun opened a new pull request, #69957: URL: https://github.com/apache/airflow/pull/69957
When `POST /connections/test` references an existing `connection_id`, it restores that connection's stored credentials (password/extra) so a saved connection can be tested without re-typing secrets. Connection configuration users have write-only access to those credentials and are not meant to view them (Airflow 3 masks them at the API level). Reusing the stored credentials while the request points at a caller-supplied host or port applies them against a destination the caller chose rather than the connection's own — outside the intent of the retype-free test flow. This scopes the credential reuse to requests that keep the stored connection's host and port; if either is overridden, the test uses exactly what the caller supplied. Follows the same hardening as #67620. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 4.8) Generated-by: Claude Code (Opus 4.8) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
