Logout the user when the token expires

[vincbeck]

Resolves #59359

There are 2 scenarios:

• If the Airflow JWT token is expired, then we should log out the user
• With Keycloak auth manager, if the refresh token is expired, then we should also log out the user.

In both cases, the user as a invalid token and is should no longer be considered as logged-in.

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

[ashb]

I think this also covers the "the encryption/signing key has changed" for local development installs, right?

[vincbeck]

I think this also covers the "the encryption/signing key has changed" for local development installs, right?

Yep

[dheerajturaga]

@vincbeck, what's the lifespan of an jwt token today? One concern here is having users to login very frequently

[bugraoz93]

@vincbeck, what's the lifespan of an jwt token today? One concern here is having users to login very frequently

It defaults to configuration for both execution and public api have different values. So admins should be able to change according to their security concerns and user behavior
For public api, it is 86400s.

airflow/airflow-core/src/airflow/config_templates/config.yml

Line 1706 in f2f1a08

jwt_expiration_time:

For execution api,

airflow/airflow-core/src/airflow/config_templates/config.yml

Line 1823 in f2f1a08

jwt_expiration_time:

[vincbeck]

@vincbeck, what's the lifespan of an jwt token today? One concern here is having users to login very frequently

By default it is one day, but it is a config so you can change it. Note that this PR does not change that. Today, after one day your token is no longer valid. The only difference is today you get alerts all over the UI because you no longer have valid credentials. This PR changes that and logs you out

[bugraoz93]

Thanks Vincent!

[dheerajturaga]

@vincbeck, what's the lifespan of an jwt token today? One concern here is having users to login very frequently

By default it is one day, but it is a config so you can change it. Note that this PR does not change that. Today, after one day your token is no longer valid. The only difference is today you get alerts all over the UI because you no longer have valid credentials. This PR changes that and logs you out

Ah! that's great! This makes sense