Spinner instad or error message when authentication flow waits by anjo0511 · Pull Request #58037 · apache/airflow

anjo0511 · 2025-11-07T11:03:32Z

Show a localized "Authenticating..." spinner instead of briefly rendering an authentication error during OAuth SSO redirects.

What changed

The Error page uses the error.authenticating i18n key and displays a spinner when the UI detects an OAuth/login flow.
Added error.authenticating translations to several locale common.json files.

closes: #57981

^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

boring-cyborg · 2025-11-07T11:03:36Z

Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide (https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
Here are some useful points:

Pay attention to the quality of your code (ruff, mypy and type annotations). Our prek-hooks will help you with that.
In case of a new feature add useful documentation (in docstrings or in docs/ directory). Adding a new operator? Check this short guide Consider adding an example DAG that shows how users should use it.
Consider using Breeze environment for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
Be sure to read the Airflow Coding style.
Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
Apache Airflow is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: dev@airflow.apache.org
Slack: https://s.apache.org/airflow-slack

guan404ming · 2025-11-12T04:20:40Z

Could you help

Fix static check error
Attach a demo or screenshot for you change
Add some desciption in PR body for your change

thanks!

guan404ming

Looks nice, needs some update

airflow-core/src/airflow/ui/src/pages/Error.tsx

…or page

bugraoz93 · 2025-11-17T16:26:09Z

My stamp more on implementation and Turkish translation. I think we might need more eyes on this one

ashb · 2025-11-17T16:59:25Z

Agreed. Commiters: lets not merge this until we've had more eyes on the translations.

Revoking approval to not cause any ambiguity. I agree to delete translations

airflow-core/src/airflow/ui/public/i18n/locales/en/common.json

pierrejeambrun

PR looks good but that shouldn't be needed. I asked more information on the related issue because I'm unsure why we are observing this at the moment and if this is the appropriate fix.

pierrejeambrun

Closing this because it's stale. More info are required on the linked issue before we can merge this (because it really shouldn't be needed, so I suspect the root cause might be missed) . This PR looks fine and we can re-open if it appears to be the necessary fix.

Fixes apache#57981 When users authenticate via Azure OAuth SSO (and other OAuth providers), the UI briefly displays an authentication error message during the OAuth redirect flow. The error appears for approximately 1 second before disappearing once authentication successfully completes. Root Cause: The issue stems from a race condition during the OAuth authentication flow. After the OAuth callback completes and the user is authenticated, the Flask session containing OAuth tokens and user data may not be fully committed to the session backend (cookie or database) before the redirect response is sent to the client. When the UI loads and immediately makes API requests (like /ui/config), these requests arrive before the session is available, causing temporary 401 Unauthorized errors. Solution: This commit introduces a CustomAuthOAuthView that extends Flask-AppBuilder's AuthOAuthView to explicitly ensure the session is committed before redirecting. The fix: 1. Created providers/fab/src/airflow/providers/fab/auth_manager/views/auth_oauth.py with CustomAuthOAuthView class 2. Override oauth_authorized() method to mark session.modified = True after parent's OAuth callback handling completes 3. Updated security_manager/override.py to use CustomAuthOAuthView instead of the default AuthOAuthView This ensures Flask's session interface saves the session via the after_request handler before the HTTP redirect response is sent to the client, eliminating the race condition. The fix addresses the root cause as suggested by maintainer feedback on PR apache#58037, rather than masking the error in the UI. Testing: - Syntax validated with py_compile - Works with both session backends (database and securecookie) - Maintains backward compatibility with existing OAuth flows Related Issues: - apache#55612 - Airflow UI initial XHR returns 401 before session cookie is set - apache#57534 - Airflow 3.1.1 oauth login failure - apache#57485 - Airflow 3.1.1 oauth login broken - PR apache#58037 - Previous UI-based workaround attempt (closed) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> Signed-off-by: Jgprog117 <gustafsonjosef@gmail.com>

Fixes apache#57981 When users authenticate via Azure OAuth SSO (and other OAuth providers), the UI briefly displays an authentication error message during the OAuth redirect flow. The error appears for approximately 1 second before disappearing once authentication successfully completes. Root Cause: The issue stems from a race condition during the OAuth authentication flow. After the OAuth callback completes and the user is authenticated, the Flask session containing OAuth tokens and user data may not be fully committed to the session backend (cookie or database) before the redirect response is sent to the client. When the UI loads and immediately makes API requests (like /ui/config), these requests arrive before the session is available, causing temporary 401 Unauthorized errors. Solution: This commit introduces a CustomAuthOAuthView that extends Flask-AppBuilder's AuthOAuthView to explicitly ensure the session is committed before redirecting. The fix: 1. Created providers/fab/src/airflow/providers/fab/auth_manager/views/auth_oauth.py with CustomAuthOAuthView class 2. Override oauth_authorized() method to mark session.modified = True after parent's OAuth callback handling completes 3. Updated security_manager/override.py to use CustomAuthOAuthView instead of the default AuthOAuthView This ensures Flask's session interface saves the session via the after_request handler before the HTTP redirect response is sent to the client, eliminating the race condition. The fix addresses the root cause as suggested by maintainer feedback on PR apache#58037, rather than masking the error in the UI. Testing: - Syntax validated with py_compile - Works with both session backends (database and securecookie) - Maintains backward compatibility with existing OAuth flows Related Issues: - apache#55612 - Airflow UI initial XHR returns 401 before session cookie is set - apache#57534 - Airflow 3.1.1 oauth login failure - apache#57485 - Airflow 3.1.1 oauth login broken - PR apache#58037 - Previous UI-based workaround attempt (closed) Signed-off-by: Jgprog117 <gustafsonjosef@gmail.com>

#61287) * Fix OAuth session race condition causing false 401 errors during login Fixes #57981 When users authenticate via Azure OAuth SSO (and other OAuth providers), the UI briefly displays an authentication error message during the OAuth redirect flow. The error appears for approximately 1 second before disappearing once authentication successfully completes. Root Cause: The issue stems from a race condition during the OAuth authentication flow. After the OAuth callback completes and the user is authenticated, the Flask session containing OAuth tokens and user data may not be fully committed to the session backend (cookie or database) before the redirect response is sent to the client. When the UI loads and immediately makes API requests (like /ui/config), these requests arrive before the session is available, causing temporary 401 Unauthorized errors. Solution: This commit introduces a CustomAuthOAuthView that extends Flask-AppBuilder's AuthOAuthView to explicitly ensure the session is committed before redirecting. The fix: 1. Created providers/fab/src/airflow/providers/fab/auth_manager/views/auth_oauth.py with CustomAuthOAuthView class 2. Override oauth_authorized() method to mark session.modified = True after parent's OAuth callback handling completes 3. Updated security_manager/override.py to use CustomAuthOAuthView instead of the default AuthOAuthView This ensures Flask's session interface saves the session via the after_request handler before the HTTP redirect response is sent to the client, eliminating the race condition. The fix addresses the root cause as suggested by maintainer feedback on PR #58037, rather than masking the error in the UI. Testing: - Syntax validated with py_compile - Works with both session backends (database and securecookie) - Maintains backward compatibility with existing OAuth flows Related Issues: - #55612 - Airflow UI initial XHR returns 401 before session cookie is set - #57534 - Airflow 3.1.1 oauth login failure - #57485 - Airflow 3.1.1 oauth login broken - PR #58037 - Previous UI-based workaround attempt (closed) Signed-off-by: Jgprog117 <gustafsonjosef@gmail.com> * Fix logging to use %-formatting instead of f-strings * Add tests for CustomAuthOAuthView * Fix linting and formatting issues in OAuth session race condition fix Remove unused imports, fix import ordering, and apply ruff formatting: - Remove unused pytest import from test_auth_oauth.py - Remove unused AuthOAuthView import from override.py - Fix import ordering to comply with ruff formatting rules - Apply ruff format to test file * Address PR review feedback from SameerMesiah97 - Remove redundant if/else branching that did the same thing in both paths - Fix misleading "completed successfully" log message to neutral wording - Replace brittle __class__.__bases__[0] mocking with explicit AuthOAuthView - Consolidate duplicate backend tests into a single parametrized test * Fix test RuntimeError by avoiding Flask session LocalProxy access Use mock.patch with new= as context manager instead of decorator to prevent mock from inspecting the Flask session LocalProxy, which requires an active request context. --------- Signed-off-by: Jgprog117 <gustafsonjosef@gmail.com>

apache#61287) * Fix OAuth session race condition causing false 401 errors during login Fixes apache#57981 When users authenticate via Azure OAuth SSO (and other OAuth providers), the UI briefly displays an authentication error message during the OAuth redirect flow. The error appears for approximately 1 second before disappearing once authentication successfully completes. Root Cause: The issue stems from a race condition during the OAuth authentication flow. After the OAuth callback completes and the user is authenticated, the Flask session containing OAuth tokens and user data may not be fully committed to the session backend (cookie or database) before the redirect response is sent to the client. When the UI loads and immediately makes API requests (like /ui/config), these requests arrive before the session is available, causing temporary 401 Unauthorized errors. Solution: This commit introduces a CustomAuthOAuthView that extends Flask-AppBuilder's AuthOAuthView to explicitly ensure the session is committed before redirecting. The fix: 1. Created providers/fab/src/airflow/providers/fab/auth_manager/views/auth_oauth.py with CustomAuthOAuthView class 2. Override oauth_authorized() method to mark session.modified = True after parent's OAuth callback handling completes 3. Updated security_manager/override.py to use CustomAuthOAuthView instead of the default AuthOAuthView This ensures Flask's session interface saves the session via the after_request handler before the HTTP redirect response is sent to the client, eliminating the race condition. The fix addresses the root cause as suggested by maintainer feedback on PR apache#58037, rather than masking the error in the UI. Testing: - Syntax validated with py_compile - Works with both session backends (database and securecookie) - Maintains backward compatibility with existing OAuth flows Related Issues: - apache#55612 - Airflow UI initial XHR returns 401 before session cookie is set - apache#57534 - Airflow 3.1.1 oauth login failure - apache#57485 - Airflow 3.1.1 oauth login broken - PR apache#58037 - Previous UI-based workaround attempt (closed) Signed-off-by: Jgprog117 <gustafsonjosef@gmail.com> * Fix logging to use %-formatting instead of f-strings * Add tests for CustomAuthOAuthView * Fix linting and formatting issues in OAuth session race condition fix Remove unused imports, fix import ordering, and apply ruff formatting: - Remove unused pytest import from test_auth_oauth.py - Remove unused AuthOAuthView import from override.py - Fix import ordering to comply with ruff formatting rules - Apply ruff format to test file * Address PR review feedback from SameerMesiah97 - Remove redundant if/else branching that did the same thing in both paths - Fix misleading "completed successfully" log message to neutral wording - Replace brittle __class__.__bases__[0] mocking with explicit AuthOAuthView - Consolidate duplicate backend tests into a single parametrized test * Fix test RuntimeError by avoiding Flask session LocalProxy access Use mock.patch with new= as context manager instead of decorator to prevent mock from inspecting the Flask session LocalProxy, which requires an active request context. --------- Signed-off-by: Jgprog117 <gustafsonjosef@gmail.com>

Authentication spinner apache#57981

89d0c2f

anjo0511 requested review from bbovenzi, guan404ming, pierrejeambrun, ryanahamilton and shubhamraj-git as code owners November 7, 2025 11:03

boring-cyborg bot added the area:UI Related to UI/UX. For Frontend Developers. label Nov 7, 2025

anjo0511 changed the title ~~Authentication spinner #57981~~ Spinner instad or error message when authentication flow waits #57981 Nov 7, 2025

guan404ming reviewed Nov 12, 2025

View reviewed changes

airflow-core/src/airflow/ui/src/pages/Error.tsx Outdated Show resolved Hide resolved

i18n: add error.authenticating translations to locales and use in Err…

9c3cd67

…or page

anjo0511 requested review from BasPH, Lee-W, ashb, bugraoz93, hussein-awala, jason810496, jscheffl, mobuchowski, potiuk, romsharon98, shahar1, vatsrahul1001 and vincbeck as code owners November 17, 2025 11:08

Merge branch 'main' into auth-spinner-57981

1fc771f

anjo0511 requested a review from guan404ming November 17, 2025 11:37

bugraoz93 previously approved these changes Nov 17, 2025

View reviewed changes

jscheffl reviewed Nov 17, 2025

View reviewed changes

airflow-core/src/airflow/ui/public/i18n/locales/en/common.json Show resolved Hide resolved

anjo0511 and others added 2 commits November 21, 2025 14:59

Merge branch 'main' into auth-spinner-57981

84396ff

revert translations all but english

31ddfe8

anjo0511 requested review from bugraoz93 and jscheffl November 21, 2025 14:16

Merge branch 'main' into auth-spinner-57981

7007c08

pierrejeambrun changed the title ~~Spinner instad or error message when authentication flow waits #57981~~ Spinner instad or error message when authentication flow waits Nov 25, 2025

pierrejeambrun added this to the Airflow 3.1.4 milestone Nov 25, 2025

pierrejeambrun added the backport-to-v3-1-test Mark PR with this label to backport to v3-1-test branch label Nov 25, 2025

pierrejeambrun reviewed Nov 25, 2025

View reviewed changes

ephraimbuddy modified the milestones: Airflow 3.1.4, Airflow 3.1.5 Dec 8, 2025

potiuk modified the milestones: Airflow 3.1.5, Airflow 3.1.6 Dec 14, 2025

ephraimbuddy modified the milestones: Airflow 3.1.6, Airflow 3.1.7 Jan 7, 2026

Lee-W removed their request for review January 9, 2026 08:14

pierrejeambrun reviewed Jan 13, 2026

View reviewed changes

pierrejeambrun closed this Jan 13, 2026

ephraimbuddy removed this from the Airflow 3.1.7 milestone Jan 28, 2026

Jgprog117 mentioned this pull request Jan 31, 2026

Fix OAuth session race condition causing false 401 errors during login #61287

Merged

shahar1 mentioned this pull request Feb 11, 2026

Status of testing Providers that were prepared on February 10, 2026 #61766

Open

81 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

Spinner instad or error message when authentication flow waits#58037

Spinner instad or error message when authentication flow waits#58037
anjo0511 wants to merge 6 commits intoapache:mainfrom
anjo0511:auth-spinner-57981

anjo0511 commented Nov 7, 2025 •

edited by pierrejeambrun

Loading

Uh oh!

boring-cyborg bot commented Nov 7, 2025

Uh oh!

guan404ming commented Nov 12, 2025

Uh oh!

guan404ming left a comment

Uh oh!

Uh oh!

bugraoz93 commented Nov 17, 2025

Uh oh!

ashb commented Nov 17, 2025

Uh oh!

Uh oh!

pierrejeambrun left a comment •

edited

Loading

Uh oh!

pierrejeambrun left a comment •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Comments

Conversation

anjo0511 commented Nov 7, 2025 • edited by pierrejeambrun Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed

Uh oh!

boring-cyborg bot commented Nov 7, 2025

Uh oh!

guan404ming commented Nov 12, 2025

Uh oh!

guan404ming left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bugraoz93 commented Nov 17, 2025

Uh oh!

ashb commented Nov 17, 2025

Uh oh!

Uh oh!

pierrejeambrun left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pierrejeambrun left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

anjo0511 commented Nov 7, 2025 •

edited by pierrejeambrun

Loading

pierrejeambrun left a comment •

edited

Loading

pierrejeambrun left a comment •

edited

Loading