stegololz opened a new pull request, #75217: URL: https://github.com/apache/airflow/pull/75217
`JWTRefreshMiddleware` appends its own `_token` `Set-Cookie` header after the response headers. When the route has already set `_token` itself, browsers apply the headers in order, so the middleware's cookie overrides the route's cookie: - **Login undone.** An auth manager login route (e.g. a callback under `/auth`) sets a fresh `_token`, but the request still carries an expired, revoked or otherwise invalid one. `resolve_user_from_token` fails, the middleware appends `_token=""; Max-Age=0` after the fresh cookie, and the user is logged out right after logging in. - **Logout undone.** `/api/v2/auth/logout` revokes the presented tokens and deletes the cookie. But if `refresh_user` returned a user for that same request, the middleware mints a new token before the route runs. It then appends that token after the route's deletion. The new token was never revoked, so the user stays logged in. The Keycloak provider already works around the login case in its own middleware (`request.state.jwt_token_issued`). That only helps Keycloak's login route, not other auth managers and not the logout case. **Fix:** in `send_with_cookies`, skip the middleware's `_token` cookie when the response already sets `_token`. The cleanup of a stale root-path `_token` (#64955) is still appended, because it targets a different path. **Tests:** three new tests in `test_refresh_token.py`, which fail without the fix: - an invalid token on a request whose route sets `_token`: only the route's cookie is sent - a refreshed user on the logout route: only the deletion is sent, no new token - with a sub-path cookie path, the route's token is kept and the stale root cookie is still cleared Related: #74722, #70783 and #70707 touch the same middleware; this change is independent of them. --- ##### Was generative AI tooling used to co-author this PR? - [x] Yes (please specify the tool below) Generated-by: Claude Code (Opus 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
