github-actions[bot] opened a new pull request, #71708: URL: https://github.com/apache/airflow/pull/71708
* Honor FORWARDED_ALLOW_IPS when the API server runs under gunicorn Running behind a TLS-terminating proxy is documented as `--proxy-headers` plus `FORWARDED_ALLOW_IPS` to say which proxies may be trusted, and that is what the uvicorn server type does. The gunicorn server type forced the trust list to every address instead, so an operator who narrowed it to their proxy silently got a server that accepted X-Forwarded-* from anyone able to reach it directly -- including the X-Forwarded-Proto that decides whether session cookies are issued with the Secure attribute. Both server types now follow the documented contract. related: #47878 * Delete airflow-core/newsfragments/71429.significant.rst * Warn about the wide gunicorn proxy-header default instead of tightening it Deployments whose proxy is not on the API server's host, and which never set FORWARDED_ALLOW_IPS, are relying on gunicorn being handed a trust list of every address. Reading the variable where it is set already gives operators back the control they thought they had; taking the wide default away from everyone else belongs in a major version. The reverse-proxy guide named uvicorn throughout, from when it was the only option. * Re-run CI after a transient go-mod-tidy download failure (cherry picked from commit d4581aecace0d7874fef1091cff08ca8edfe042d) Co-authored-by: rjgoyln <[email protected]> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
