potiuk opened a new pull request, #72649:
URL: https://github.com/apache/airflow/pull/72649
The Core API logout endpoint read only the `_token` cookie.
A client authenticating with an `Authorization: Bearer` header — the
documented
way to call the Core API — therefore received a normal logout response while
its
token was never revoked. The token stayed valid until it expired; the default
lifetime is 24 hours and is configurable.
The practical effect is that a copy of the token held by anyone else
survives the
holder's logout: asking to be logged out did not end the session it was
presented
for.
### The change
* `get_user()`'s credential selection is extracted into
`select_request_token()`
and shared, so authentication and logout agree on what a request's
credential
is instead of each hard-coding a choice.
* Logout uses `collect_request_tokens()` and revokes **all** credentials
presented, not just the precedence-selected one. Revoking only the winner
would
leave any other credential the caller presented valid after they asked to
be
logged out — and which credential wins is a question about *authentication*
that should not decide what a *logout* terminates.
* Revocation still happens before any redirect or cookie deletion, so an
external
auth-manager logout URL cannot skip it.
The refactor is behaviour-preserving for `get_user()`: the trusted-middleware
shortcut is untouched and the same precedence (bearer → OAuth token → cookie)
applies after it.
### Tests
Bearer-only logout, bearer plus cookie together, bearer before an external
redirect, and revocation when a user has been cached by
`JWTRefreshMiddleware`
(so the trusted-user shortcut cannot cause logout to skip revocation).
Against unpatched sources the bearer tests fail with `assert False is True` —
the token is simply not revoked. The existing cookie tests are unchanged and
still pass, as do the 129 tests in `test_security.py` plus this file.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (please specify the tool below)
Generated-by: Claude Code following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
