KushagraB424 opened a new pull request, #70081:
URL: https://github.com/apache/airflow/pull/70081
<!-- SPDX-License-Identifier: Apache-2.0
https://www.apache.org/licenses/LICENSE-2.0 -->
### Description
The Task Execution API's `set_xcom` endpoint implicitly has access to the
current task instance identifiers through the injected JWT token. Removing the
task identifiers (`dag_id`, `run_id`, `task_id`) from the URL simplifies
routing, prevents clients from providing conflicting or invalid identifiers,
and enforces zero-trust security where a task instance can only write its own
XComs.
This refactor:
- Updates the `has_xcom_access` dependency to handle write requests
gracefully without requiring `dag_id` in the URL path.
- Modifies the `set_xcom` endpoint to query identifiers securely from the
database via the token.
- Cleans up `client.xcoms.set` in the Task SDK to use the simplified URL
format.
closes: #70080
---
##### Was generative AI tooling used to co-author this PR?
- [x] Yes (please specify the tool below)
Generated-by: [Gemini] following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
