0x000A opened a new pull request, #76362:
URL: https://github.com/apache/airflow/pull/76362
When a user opens a deep link, such as a Dag run or task log, without a
valid session, the UI sends them to `/api/v2/auth/login?next=<page>`. Core
passes `next` on to the Keycloak
auth manager's `/auth/login`. That route never reads it. After the user
signs in, `login_callback` always redirects to `[api] base_url`, so they land
on the home page and have to
open the link a second time.
The same bug was fixed for `SimpleAuthManager` in #67483 and #67965, and
for `FabAuthManager` in #73134. This change does the same for the Keycloak auth
manager.
### Changes
- `/auth/login` checks `next` with `is_safe_url` and keeps it in a
short-lived httponly cookie (`_login_next_url`, 5 minutes, same as the OAuth
state cookie). If `next` is missing or
unsafe, any leftover cookie from an earlier unfinished login is cleared.
- `/auth/login_callback` redirects to that URL after checking it again,
falling back to `[api] base_url` as before. It clears the cookie in both cases.
- `get_url_login(next_url=...)` now adds `next` to the login URL instead
of ignoring it, as #67965 and #73134 did for the other auth managers.
The target is kept in a cookie rather than in the OAuth `state`. `state`
is a random value checked against its own cookie, so it stays independent of
anything the user can influence.
### Testing
- Unit tests for safe and unsafe `next` values (absolute URLs to another
host, `//host`, `javascript:`), a missing `next`, clearing a leftover target,
and `get_url_login` with
`next_url`.
- Tried by hand against a real Keycloak (26.4) with Airflow 3.3.2 and this
branch. Signing in from
`/dags/<dag>/runs/scheduled__2026-11-03T06:30:00+00:00/tasks/<task>?try_number=2`
now returns to that exact page, where unpatched 0.11.2 returns to `/`.
Sending `https://attacker.example.net/...`, `//attacker.example.net/...` or
`/\attacker.example.net/...`
directly to `/auth/login` still lands on `/`.
related: #67476, #73133
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Claude Opus 5.5)
Generated-by: Claude Code (Claude Opus 5.5) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
