fix: Add missing security settings for session cookie

[LipuFei]

Add the following security-related session cookie settings that was missing:

• SESSION_COOKIE_HTTPONLY = True
• SESSION_COOKIE_SECURE comes from config [fab] COOKIE_SECURE
• SESSION_COOKIE_SAMESITE comes from config [fab] COOKIE_SAMESITE
• config [webserver] COOKIE_SECURE is renamed to [fab] COOKIE_SECURE
• config [webserver] COOKIE_SAMESITE is renamed to [fab] COOKIE_SAMESITE

We may want to change the config location because this is now in api-server in 3.0?

[vincbeck]

We marked these configs as deleted in airflow-ctl/src/airflowctl/ctl/commands/config_command.py. If we want to use them back, we should them remove them from airflow-ctl/src/airflowctl/ctl/commands/config_command.py as well.

[LipuFei]

We marked these configs as deleted in airflow-ctl/src/airflowctl/ctl/commands/config_command.py. If we want to use them back, we should them remove them from airflow-ctl/src/airflowctl/ctl/commands/config_command.py as well.

Hi @vincelevey , I don't necessarily need these options back, but I found that with self-hosting, the api-server doesn't have these options on by default. I can see from Firefox that my session cookie is not HTTP-only, and not secure, etc.

Perhaps you know a better way to have them configured in api-server in 3.0?

I currently just add these 3 options in the api-server config python file via the Helm chart values, and it works. I think it would be great if these options can be set more transparently.

[vincbeck]

We marked these configs as deleted in airflow-ctl/src/airflowctl/ctl/commands/config_command.py. If we want to use them back, we should them remove them from airflow-ctl/src/airflowctl/ctl/commands/config_command.py as well.

Hi @vincelevey , I don't necessarily need these options back, but I found that with self-hosting, the api-server doesn't have these options on by default. I can see from Firefox that my session cookie is not HTTP-only, and not secure, etc.

Perhaps you know a better way to have them configured in api-server in 3.0?

I currently just add these 3 options in the api-server config python file via the Helm chart values, and it works. I think it would be great if these options can be set more transparently.

You are using these config so you need them back and I think this is okay. You are using these configs conf.getboolean("webserver", "COOKIE_SECURE") and conf.get("webserver", "COOKIE_SAMESITE"). I think the right approach would be to move these config to Fab provider because they are specific to Fab. Once done you would need to update airflow-core/src/airflow/cli/commands/config_command.py and airflow-ctl/src/airflowctl/ctl/commands/config_command.py to no longer mark them as deleted but moved from webserver to fab. This PR is a good example on how to do that.

[LipuFei]

We marked these configs as deleted in airflow-ctl/src/airflowctl/ctl/commands/config_command.py. If we want to use them back, we should them remove them from airflow-ctl/src/airflowctl/ctl/commands/config_command.py as well.

Hi @vincelevey , I don't necessarily need these options back, but I found that with self-hosting, the api-server doesn't have these options on by default. I can see from Firefox that my session cookie is not HTTP-only, and not secure, etc.

Perhaps you know a better way to have them configured in api-server in 3.0?

I currently just add these 3 options in the api-server config python file via the Helm chart values, and it works. I think it would be great if these options can be set more transparently.

You are using these config so you need them back and I think this is okay. You are using these configs conf.getboolean("webserver", "COOKIE_SECURE") and conf.get("webserver", "COOKIE_SAMESITE"). I think the right approach would be to move these config to Fab provider because they are specific to Fab. Once done you would need to update airflow-core/src/airflow/cli/commands/config_command.py and airflow-ctl/src/airflowctl/ctl/commands/config_command.py to no longer mark them as deleted but moved from webserver to fab. This PR is a good example on how to do that.

Thank you. I will check that PR and update my changes.

[vin100bk]

Nice! Thanks for taking the time to update the PR :) Much appreciated

[vincbeck]

Nice! Thanks for taking the time to update the PR :) Much appreciated

[snowsky]

Will this fix be included in the next release? Thanks!

Update: a quick question, not sure if this issue is related, #47878, which will be released in 3.2.0.

[vincbeck]

Will this fix be included in the next release? Thanks!

It is mostly a provider change so this is already released in the latest fab provider version

[snowsky]

Will this fix be included in the next release? Thanks!

It is mostly a provider change so this is already released in the latest fab provider version

Is this env var still valid AIRFLOW__WEBSERVER__COOKIE_SECURE? I saw it was introduced in version 1.3 but didn't find it in version 3 docs.

[vincbeck]

It is now AIRFLOW__FAB__COOKIE_SECURE