Add FAB option to log users out after a maximum session lifetime - #72825
Merged
Merged
Conversation
eladkal
approved these changes
Sep 9, 2026
o-nikolas
reviewed
Sep 10, 2026
o-nikolas
left a comment
Contributor
There was a problem hiding this comment.
Seems reasonable overall to me, agent found a few things, I pulled out the too I think are most salient.
vincbeck
force-pushed
the
vincbeck/fab-session-max-lifetime
branch
from
September 11, 2026 15:19
631d202 to
e6cff47
Compare
1 task
ShousenZHANG
added a commit
to ShousenZHANG/airflow
that referenced
this pull request
Sep 11, 2026
Five of the seven `providers/fab/.../www/extensions/` modules were listed in `OVERLOOKED_TESTS` with no tests at all, and `create_app()` calls all five while building the Flask app, so a regression in any of them either stops the app from starting or silently changes what it serves. What the tests pin, per module: - `init_wsgi_middlewares`: the five `[fab] proxy_fix_x_*` options are set to five distinct values, so a mix-up between the five near-identical `ProxyFix` keyword arguments fails; and `wsgi_app` is left untouched when the option is off. - `init_security`: the comma split and per-entry strip, the import order, the default backend, and `ImportError` becoming `AirflowException`. An empty `auth_backends` raises `ValueError` instead, which `except ImportError` does not catch - recorded as current behaviour. - `init_jinja_globals`: the three `default_timezone` branches including the non-callable guard, hostname redaction when `[fab] expose_hostname` is off, the four navbar colours, and the two opposite globals driven by `enable_plugins`. - `init_manifest_files`: the `dist/` prefixing, the fallback to the raw filename when the manifest is missing or the key is unknown, and the debug-mode re-read. - `init_views`: `view` not being forwarded twice for named views, `add_view_no_menu` for unnamed ones, the named-view-without-a-view log, blueprint registration, and the 500/404 handler pair. Verified by mutation rather than by assertion count: 22 one-line breakages of the five modules were each applied in turn, and all 22 make the new tests fail. Drops the five matching paths from `OVERLOOKED_TESTS`, leaving `init_appbuilder` (615 lines, its own PR) and `init_session` (already covered by apache#72825). Generated-by: Claude Code
vincbeck
force-pushed
the
vincbeck/fab-session-max-lifetime
branch
from
September 15, 2026 12:48
e6cff47 to
e77ecb3
Compare
vincbeck
force-pushed
the
vincbeck/fab-session-max-lifetime
branch
from
September 15, 2026 15:22
e77ecb3 to
f321f1d
Compare
Deployments with compliance requirements need users to re-authenticate on a fixed schedule. The existing [fab] session_lifetime_minutes cannot express that: it is an inactivity deadline, and an Airflow UI tab left open keeps the session active on its own because the UI polls the API in the background and silently re-authenticates whenever its token expires, so the deadline never arrives. Reported in apache#48787.
vincbeck
force-pushed
the
vincbeck/fab-session-max-lifetime
branch
from
September 15, 2026 15:23
f321f1d to
8ebba11
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Deployments with compliance requirements need users to re-authenticate on a fixed schedule. The existing [fab] session_lifetime_minutes cannot express that: it is an inactivity deadline, and an Airflow UI tab left open keeps the session active on its own because the UI polls the API in the background and silently re-authenticates whenever its token expires, so the deadline never arrives.
Reported in #48787.
Was generative AI tooling used to co-author this PR?
{pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.