Flask-Session MessagePack DecodeError causes Airflow webserver crash on Python 3.12

[MammadTavakoli]

Apache Airflow version

3.1.1

If "Other Airflow 2/3 version" selected, which one?

No response

What happened?

When running Airflow webserver on Python 3.12 that instaled with docker, I encountered a crash in the Flask session handling. The traceback indicates that msgspec.DecodeError occurs due to malformed MessagePack data, and subsequently AttributeError: 'NoneType' object has no attribute 'get' is raised when Flask-Login tries to access the session.

What you think should happen instead?

in airflow 3.1.0 it work correctly but in air flow 3.1.1 and 3.1.2rcq nad rc2 have following error:

| File "/home/airflow/.local/lib/python3.12/site-packages/starlette/_exception_handler.py", line 53, in wrapped_app
| raise exc
| File "/home/airflow/.local/lib/python3.12/site-packages/starlette/_exception_handler.py", line 42, in wrapped_app
| await app(scope, receive, sender)
| File "/home/airflow/.local/lib/python3.12/site-packages/starlette/routing.py", line 716, in call
| await self.middleware_stack(scope, receive, send)
| File "/home/airflow/.local/lib/python3.12/site-packages/starlette/routing.py", line 736, in app
| await route.handle(scope, receive, send)
| File "/home/airflow/.local/lib/python3.12/site-packages/starlette/routing.py", line 462, in handle
| await self.app(scope, receive, send)
| File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/wsgi.py", line 81, in call
| await responder(receive, send)
| File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/wsgi.py", line 106, in call
| async with anyio.create_task_group() as task_group:
| ^^^^^^^^^^^^^^^^^^^^^^^^^
| File "/home/airflow/.local/lib/python3.12/site-packages/anyio/_backends/_asyncio.py", line 781, in aexit
| raise BaseExceptionGroup(
| ExceptionGroup: unhandled errors in a TaskGroup (1 sub-exception)
+-+---------------- 1 ----------------
| Traceback (most recent call last):
| File "/home/airflow/.local/lib/python3.12/site-packages/flask/app.py", line 2528, in wsgi_app
| ctx.push()
| File "/home/airflow/.local/lib/python3.12/site-packages/flask/ctx.py", line 375, in push
| self.session = session_interface.open_session(self.app, self.request)
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
| File "/home/airflow/.local/lib/python3.12/site-packages/flask_session/base.py", line 350, in open_session
| saved_session_data = self._retrieve_session_data(store_id)
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
| File "/home/airflow/.local/lib/python3.12/site-packages/flask_session/_utils.py", line 56, in wrapper
| raise e
| File "/home/airflow/.local/lib/python3.12/site-packages/flask_session/_utils.py", line 52, in wrapper
| return func(*args, **kwargs)
| ^^^^^^^^^^^^^^^^^^^^^
| File "/home/airflow/.local/lib/python3.12/site-packages/flask_session/sqlalchemy/sqlalchemy.py", line 152, in _retrieve_session_data
| return self.serializer.decode(serialized_session_data)
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
| File "/home/airflow/.local/lib/python3.12/site-packages/airflow/providers/fab/www/session.py", line 37, in decode
| return decoder.decode(data)
| ^^^^^^^^^^^^^^^^^^^^
| msgspec.DecodeError: MessagePack data is malformed: trailing characters (byte 1)
|
| During handling of the above exception, another exception occurred:
|
| Traceback (most recent call last):
| File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/wsgi.py", line 109, in call
| await anyio.to_thread.run_sync(self.wsgi, environ, self.start_response)
| File "/home/airflow/.local/lib/python3.12/site-packages/anyio/to_thread.py", line 56, in run_sync
| return await get_async_backend().run_sync_in_worker_thread(
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
| File "/home/airflow/.local/lib/python3.12/site-packages/anyio/_backends/_asyncio.py", line 2485, in run_sync_in_worker_thread
| return await future
| ^^^^^^^^^^^^
| File "/home/airflow/.local/lib/python3.12/site-packages/anyio/_backends/_asyncio.py", line 976, in run
| result = context.run(func, *args)
| ^^^^^^^^^^^^^^^^^^^^^^^^
| File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/wsgi.py", line 147, in wsgi
| for chunk in self.app(environ, start_response):
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
| File "/home/airflow/.local/lib/python3.12/site-packages/flask/app.py", line 2552, in call
| return self.wsgi_app(environ, start_response)
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
| File "/home/airflow/.local/lib/python3.12/site-packages/flask/app.py", line 2532, in wsgi_app
| response = self.handle_exception(e)
| ^^^^^^^^^^^^^^^^^^^^^^^^
| File "/home/airflow/.local/lib/python3.12/site-packages/flask/app.py", line 1727, in handle_exception
| server_error = self.ensure_sync(handler)(server_error)
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
| File "/home/airflow/.local/lib/python3.12/site-packages/airflow/providers/fab/www/views.py", line 88, in show_traceback
| return render_template("airflow/traceback.html"), 500
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
| File "/home/airflow/.local/lib/python3.12/site-packages/flask/templating.py", line 147, in render_template
| return _render(app, template, context)
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
| File "/home/airflow/.local/lib/python3.12/site-packages/flask/templating.py", line 128, in _render
| app.update_template_context(context)
| File "/home/airflow/.local/lib/python3.12/site-packages/flask/app.py", line 997, in update_template_context
| context.update(func())
| ^^^^^^
| File "/home/airflow/.local/lib/python3.12/site-packages/flask_login/utils.py", line 405, in _user_context_processor
| return dict(current_user=_get_user())
| ^^^^^^^^^^^
| File "/home/airflow/.local/lib/python3.12/site-packages/flask_login/utils.py", line 370, in _get_user
| current_app.login_manager._load_user()
| File "/home/airflow/.local/lib/python3.12/site-packages/flask_login/login_manager.py", line 362, in _load_user
| user_id = session.get("_user_id")
| ^^^^^^^^^^^
| AttributeError: 'NoneType' object has no attribute 'get'
+------------------------------------
INFO: 10.3.1.116:54442 - "GET /favicon.ico HTTP/1.1" 200 OK
INFO: 127.0.0.1:55914 - "GET /api/v2/version HTTP/1.1" 200 OK

How to reproduce

I installed with docker

Operating System

ubuntu 24.04

Versions of Apache Airflow Providers

airflow 3.1.1 and 3.1.2rc2

Deployment

Official Apache Airflow Helm Chart

Deployment details

No response

Anything else?

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[VertexToEdge]

same here.
but, It was gone when i logged in with private tab in chrome.

[eladkal]

cc @vincbeck

[potiuk]

Coudl be because you use test version of airflow in the same browser and some old cookies were left. 2.11.1 in -progress had some time when messagepack cookies were used instead of json ones. Also some experimenting with flask-session configuration might cause it - when you change the version of flask-session or switch between main/real version they might use different type of cookies. Clearing cookies in this case is the best solution.

[MammadTavakoli]

thanks. after i Clearing cookies it worked well.

[JarrColl]

I'm also having the same error on versions 3.1.1 and 3.1.2, it happens immediately when loading the webpage.

Using a private browser does not resolve the error in this case. The error occurs when configuring fab to use the securecookie session backend.

    [fab]
    session_lifetime_minutes = 720
    session_backend = securecookie

The error doesn't occur after commenting out the above config.

Here is the error:

INFO:     10.10.138.220:39824 - "GET /favicon.ico HTTP/1.1" 200 OK
2025-11-12T00:34:06.397819Z [error    ] Exception on /login/ [GET]     [airflow.providers.fab.www.app] loc=app.py:1744
Traceback (most recent call last):
  File "/home/nbnai_user/.local/lib/python3.12/site-packages/flask/app.py", line 2528, in wsgi_app
    ctx.push()
  File "/home/nbnai_user/.local/lib/python3.12/site-packages/flask/ctx.py", line 375, in push
    self.session = session_interface.open_session(self.app, self.request)
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/nbnai_user/.local/lib/python3.12/site-packages/flask/sessions.py", line 363, in open_session
    s = self.get_signing_serializer(app)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/nbnai_user/.local/lib/python3.12/site-packages/flask/sessions.py", line 353, in get_signing_serializer
    return URLSafeTimedSerializer(
           ^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/nbnai_user/.local/lib/python3.12/site-packages/itsdangerous/serializer.py", line 222, in __init__
    self.is_text_serializer: bool = is_text_serializer(serializer)
                                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/nbnai_user/.local/lib/python3.12/site-packages/itsdangerous/serializer.py", line 39, in is_text_serializer
    return isinstance(serializer.dumps({}), str)
                      ^^^^^^^^^^^^^^^^
AttributeError: '_LazySafeSerializer' object has no attribute 'dumps'
INFO:     10.10.138.220:39824 - "GET /auth/login/ HTTP/1.1" 500 Internal Server Error
ERROR:    Exception in ASGI application
  + Exception Group Traceback (most recent call last):
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/uvicorn/protocols/http/httptools_impl.py", line 409, in run_asgi
  |     result = await app(  # type: ignore[func-returns-value]
  |              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/fastapi/applications.py", line 1082, in __call__
  |     await super().__call__(scope, receive, send)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/applications.py", line 113, in __call__
  |     await self.middleware_stack(scope, receive, send)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/middleware/errors.py", line 186, in __call__
  |     raise exc
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/middleware/errors.py", line 164, in __call__
  |     await self.app(scope, receive, _send)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/middleware/gzip.py", line 29, in __call__
  |     await responder(scope, receive, send)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/middleware/gzip.py", line 130, in __call__
  |     await super().__call__(scope, receive, send)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/middleware/gzip.py", line 46, in __call__
  |     await self.app(scope, receive, self.send_with_compression)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/middleware/cors.py", line 85, in __call__
  |     await self.app(scope, receive, send)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/middleware/exceptions.py", line 63, in __call__
  |     await wrap_app_handling_exceptions(self.app, conn)(scope, receive, send)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/_exception_handler.py", line 53, in wrapped_app
  |     raise exc
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/_exception_handler.py", line 42, in wrapped_app
  |     await app(scope, receive, sender)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/routing.py", line 716, in __call__
  |     await self.middleware_stack(scope, receive, send)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/routing.py", line 736, in app
  |     await route.handle(scope, receive, send)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/routing.py", line 462, in handle
  |     await self.app(scope, receive, send)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/fastapi/applications.py", line 1082, in __call__
  |     await super().__call__(scope, receive, send)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/applications.py", line 113, in __call__
  |     await self.middleware_stack(scope, receive, send)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/middleware/errors.py", line 186, in __call__
  |     raise exc
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/middleware/errors.py", line 164, in __call__
  |     await self.app(scope, receive, _send)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/middleware/exceptions.py", line 63, in __call__
  |     await wrap_app_handling_exceptions(self.app, conn)(scope, receive, send)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/_exception_handler.py", line 53, in wrapped_app
  |     raise exc
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/_exception_handler.py", line 42, in wrapped_app
  |     await app(scope, receive, sender)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/routing.py", line 716, in __call__
  |     await self.middleware_stack(scope, receive, send)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/routing.py", line 736, in app
  |     await route.handle(scope, receive, send)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/routing.py", line 462, in handle
  |     await self.app(scope, receive, send)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/middleware/wsgi.py", line 81, in __call__
  |     await responder(receive, send)
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/middleware/wsgi.py", line 106, in __call__
  |     async with anyio.create_task_group() as task_group:
  |                ^^^^^^^^^^^^^^^^^^^^^^^^^
  |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/anyio/_backends/_asyncio.py", line 781, in __aexit__
  |     raise BaseExceptionGroup(
  | ExceptionGroup: unhandled errors in a TaskGroup (1 sub-exception)
  +-+---------------- 1 ----------------
    | Traceback (most recent call last):
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/flask/app.py", line 2528, in wsgi_app
    |     ctx.push()
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/flask/ctx.py", line 375, in push
    |     self.session = session_interface.open_session(self.app, self.request)
    |                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/flask/sessions.py", line 363, in open_session
    |     s = self.get_signing_serializer(app)
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/flask/sessions.py", line 353, in get_signing_serializer
    |     return URLSafeTimedSerializer(
    |            ^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/itsdangerous/serializer.py", line 222, in __init__
    |     self.is_text_serializer: bool = is_text_serializer(serializer)
    |                                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/itsdangerous/serializer.py", line 39, in is_text_serializer
    |     return isinstance(serializer.dumps({}), str)
    |                       ^^^^^^^^^^^^^^^^
    | AttributeError: '_LazySafeSerializer' object has no attribute 'dumps'
    |
    | During handling of the above exception, another exception occurred:
    |
    | Traceback (most recent call last):
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/middleware/wsgi.py", line 109, in __call__
    |     await anyio.to_thread.run_sync(self.wsgi, environ, self.start_response)
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/anyio/to_thread.py", line 56, in run_sync
    |     return await get_async_backend().run_sync_in_worker_thread(
    |            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/anyio/_backends/_asyncio.py", line 2485, in run_sync_in_worker_thread
    |     return await future
    |            ^^^^^^^^^^^^
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/anyio/_backends/_asyncio.py", line 976, in run
    |     result = context.run(func, *args)
    |              ^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/starlette/middleware/wsgi.py", line 147, in wsgi
    |     for chunk in self.app(environ, start_response):
    |                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/flask/app.py", line 2552, in __call__
    |     return self.wsgi_app(environ, start_response)
    |            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/werkzeug/middleware/proxy_fix.py", line 187, in __call__
    |     return self.app(environ, start_response)
    |            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/flask/app.py", line 2532, in wsgi_app
    |     response = self.handle_exception(e)
    |                ^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/flask/app.py", line 1727, in handle_exception
    |     server_error = self.ensure_sync(handler)(server_error)
    |                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/airflow/providers/fab/www/views.py", line 88, in show_traceback
    |     return render_template("airflow/traceback.html"), 500
    |            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/flask/templating.py", line 147, in render_template
    |     return _render(app, template, context)
    |            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/flask/templating.py", line 128, in _render
    |     app.update_template_context(context)
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/flask/app.py", line 997, in update_template_context
    |     context.update(func())
    |                    ^^^^^^
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/flask_login/utils.py", line 405, in _user_context_processor
    |     return dict(current_user=_get_user())
    |                              ^^^^^^^^^^^
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/flask_login/utils.py", line 370, in _get_user
    |     current_app.login_manager._load_user()
    |   File "/home/nbnai_user/.local/lib/python3.12/site-packages/flask_login/login_manager.py", line 362, in _load_user
    |     user_id = session.get("_user_id")
    |               ^^^^^^^^^^^
    | AttributeError: 'NoneType' object has no attribute 'get'
    +------------------------------------

[vincbeck]

This is fixed by #57578, and it has been released in 3.1.3. Closing.