Authentication Issues with Airflow in Docker: 401 Unauthorized on /ui/config with Multiple Web Server Workers

[MammadTavakoli]

Apache Airflow version

3.0.0

If "Other Airflow 2 version" selected, which one?

No response

What happened?

Hi,
I'm running Apache Airflow in a Docker environment using Docker Compose with multiple web server workers (4 workers using Uvicorn). I'm experiencing authentication issues where, after logging in successfully, I get 401 Unauthorized responses when accessing the /ui/config API endpoint.
Here's a snippet from the logs:

[2025-04-29T10:25:05.579+0000] {api_server_command.py:92} INFO - Running the uvicorn with:
Workers: 4
Host: 0.0.0.0:8080
Timeout: 120
Logfiles: -
=================================================================
INFO:     Uvicorn running on http://0.0.0.0:8080 (Press CTRL+C to quit)
INFO:     Started parent process [7]
...
INFO:     192.168.17.24:55984 - "POST /auth/login/?next=http://10.1.13.234:8086/ HTTP/1.1" 302 Found
INFO:     192.168.17.24:55984 - "GET / HTTP/1.1" 200 OK
...
INFO:     192.168.17.24:55984 - "GET /ui/config HTTP/1.1" 401 Unauthorized
INFO:     192.168.17.24:55984 - "GET /api/v2/auth/login?next=http%3A%2F%2F10.1.13.234%3A8086%2F HTTP/1.1" 307 Temporary Redirect
...

I'm not sure if the AIRFLOW__WEBSERVER__SECRET_KEY is set consistently across all workers. I suspect that each worker might be using a different secret key, causing session cookies to be invalidated when requests are handled by different workers.
Is this a possible cause of the issue? If so, how can I ensure that all workers use the same secret key in my Docker Compose setup? For example, should I add an environment variable like AIRFLOW__WEBSERVER__SECRET_KEY=my_secret_key to my Docker Compose file?
Are there any other configurations or settings I should check to resolve this authentication problem?
Thank you for your assistance!

What you think should happen instead?

No response

How to reproduce

I use following help to install in ubuntu server:

https://airflow.apache.org/docs/apache-airflow/stable/howto/docker-compose/index.html#fetching-docker-compose-yaml

Operating System

ubuntu

Versions of Apache Airflow Providers

3.0.0

Deployment

Official Apache Airflow Helm Chart

Deployment details

No response

Anything else?

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[boring-cyborg]

Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.

[tirkarthi]

Since this is regarding redirection loop it looks similar to below issue

#49495

The thread has different approaches.

#49721 (comment)

You should also ensure jwt_secret is consistent across workers in different instances.

https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html#jwt-secret

[jbanha]

I had a separate issue with configurations where I missed updating the keys from 2.X. Is AIRFLOW__API__SECRET_KEY not supposed to replace your AIRFLOW__WEBSERVER__SECRET_KEY?

[vincbeck]

This used to be a bug in 3.0.0 where users needed to have read config permissions to access GET /ui/config endpoint. This issue has been fixed since then