pierrejeambrun opened a new pull request, #72196: URL: https://github.com/apache/airflow/pull/72196
The auth-manager security views (Users, Roles, …) and the legacy plugin views render inside an iframe, but the browser address bar stayed on the outer route (`/security/users`) while the user navigated inside the frame. That broke deep linking: an inner page like editing a specific user couldn't be bookmarked, shared, or reloaded, and Back/Forward did nothing. A shared `useIframeUrlSync` hook now mirrors the framed same-origin location into the address bar (via `replace`, so the iframe's own history drives Back/Forward) and reconstructs it from the URL on load, so those pages are linkable again. Both iframe surfaces (`Security` and the plugin `Iframe`) use it; the security route gains a splat to carry the inner path. Syncing is same-origin only — a cross-origin frame's location can't be read, and deep links are validated to resolve to the app origin before being applied, so a crafted URL can't point the frame off-site. closes: #55815 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 4.8) Generated-by: Claude Code (Opus 4.8) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
