KushagraB424 opened a new issue, #70080:
URL: https://github.com/apache/airflow/issues/70080
### Description
Currently, the `/execution/xcoms/{dag_id}/{run_id}/{task_id}/{key}` endpoint
in the Execution API accepts the DAG ID, Run ID, and Task ID as URL parameters.
However, since the Task SDK now authenticates with the Execution API using a
short-lived JWT token that is inherently scoped to the specific task instance,
passing these identifiers in the URL is redundant and bypasses the zero-trust
model.
An existing `TODO` in `xcoms.py` notes that we should remove these
parameters from the URL and rely entirely on the information embedded in the
JWT token (or looked up via the token ID).
### Use case/motivation
- **Security**: Enforces that the worker can only set XComs for the exact
task instance it is authorized for (zero-trust model).
- **Simplicity**: Cleans up the URL structure and routing logic.
- **Payload/Path Reduction**: Removes redundant path variables that the
worker shouldn't have to explicitly specify anyway.
### Related issues
_No response_
### Are you willing to submit a PR?
- [x] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of
Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
