github-actions[bot] opened a new pull request, #72933: URL: https://github.com/apache/airflow/pull/72933
logout() read only the _token cookie. A client authenticating with an Authorization: Bearer header -- the documented way to call the Core API -- therefore received a normal logout response while its token was never revoked, and that token stayed valid until it expired. The default lifetime is 24 hours. A copy of the token held by anyone else survived the holder's logout, so asking to be logged out did not end the session it was presented for. Logout uses collect_request_tokens() and revokes all of them, not just the precedence-selected one. It walks the same order get_user() authenticates by, so logout does not hard-code its own separate answer to what a request's credentials are. Revoking only the winner would leave any other credential the caller presented valid after they asked to be logged out, and which credential wins is a question about authentication that should not decide what a logout terminates. Revocation still happens before any redirect or cookie deletion, so an external auth-manager logout URL cannot skip it. The bearer tests fail against unpatched sources with 'assert False is True' -- the token is simply not revoked. (cherry picked from commit 3f0a5d61fa8e6d8c0c5f6f48559ec350c026903a) Co-authored-by: Jarek Potiuk <[email protected]> Generated-by: Claude Code (Opus 5) Claude-Session: https://claude.ai/code/session_01XS3bodTDYYGrPmorhtLsjP -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
