The GitHub Actions job "Tests (AMD)" on airflow.git/backport-d4581ae-v3-3-test has succeeded. Run started by GitHub user github-actions[bot] (triggered by pierrejeambrun).
Head commit for run: 110e1cd36d7e6d3faf5421bd3c3ccc1c0332d3c4 / rjgoyln <[email protected]> [v3-3-test] Honor FORWARDED_ALLOW_IPS when the API server runs under gunicorn (#71429) * Honor FORWARDED_ALLOW_IPS when the API server runs under gunicorn Running behind a TLS-terminating proxy is documented as `--proxy-headers` plus `FORWARDED_ALLOW_IPS` to say which proxies may be trusted, and that is what the uvicorn server type does. The gunicorn server type forced the trust list to every address instead, so an operator who narrowed it to their proxy silently got a server that accepted X-Forwarded-* from anyone able to reach it directly -- including the X-Forwarded-Proto that decides whether session cookies are issued with the Secure attribute. Both server types now follow the documented contract. related: #47878 * Delete airflow-core/newsfragments/71429.significant.rst * Warn about the wide gunicorn proxy-header default instead of tightening it Deployments whose proxy is not on the API server's host, and which never set FORWARDED_ALLOW_IPS, are relying on gunicorn being handed a trust list of every address. Reading the variable where it is set already gives operators back the control they thought they had; taking the wide default away from everyone else belongs in a major version. The reverse-proxy guide named uvicorn throughout, from when it was the only option. * Re-run CI after a transient go-mod-tidy download failure (cherry picked from commit d4581aecace0d7874fef1091cff08ca8edfe042d) Co-authored-by: rjgoyln <[email protected]> Report URL: https://github.com/apache/airflow/actions/runs/32022901409 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
