safaehar opened a new pull request, #76741: URL: https://github.com/apache/airflow/pull/76741
When an unauthenticated browser opens an Airflow UI route, the API server currently serves `index.html`. The browser can then download and initialize the React application before the first protected UI request returns `401` and sends it to the login flow. This causes an unauthorized-page flash and spends the application bootstrap on a page the user cannot access. An observed unauthenticated initial view spent about 2.1 seconds in this flow before `/ui/config` returned `401`. The exact duration depends on the client and cache state, but the work is unnecessary in every case. This change resolves authentication on the SPA catch-all route and redirects unauthenticated HTML page navigations through Airflow's existing login endpoint before serving the application: - The original path and query string are preserved, including deployments under a root path. - Static resources and other non-HTML catch-all requests keep their existing behavior. - Authenticated page loads reuse the user already resolved by the JWT refresh middleware, avoiding a second token decode or revocation lookup. - Invalid sessions still clear their token cookie on the redirect response, preventing redirect loops. The result removes the unused React download/initialization and initial protected API round trip from the unauthenticated path. Tests cover unauthenticated and authenticated page loads, invalid-session cookie cleanup, non-page requests, query/root-path preservation, and authentication error handling. The selective core, FAB/common-compat provider, and documentation checks pass locally. related: #55612 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Codex (GPT-5) Generated-by: Codex (GPT-5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) --- * Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information. Note: commit author/co-author name and email in commits become permanently public when merged. * For fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed. * When adding dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x). * For significant user-facing changes create newsfragment: `{pr_number}.significant.rst`, in [airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments). You can add this file in a follow-up commit after the PR is created so you know the PR number. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
