anmolxlight opened a new pull request, #70029:
URL: https://github.com/apache/airflow/pull/70029
## Summary
When Airflow is behind a reverse proxy that terminates TLS (e.g.
EntraID/Azure AD SSO), the OAuth redirect URI generated by
`url_for(".oauth_authorized", _external=True)` uses `http://` instead of
`https://`. This is because the WSGI environ `wsgi.url_scheme` remains `http`
(the proxy forwards as HTTP to the backend), and even when `[fab]
enable_proxy_fix = True` is configured, some proxy setups may not properly
update the scheme.
## Root cause
The FAB AuthOAuthView.login() method constructs the redirect URI with
`url_for(".oauth_authorized", provider=provider, _external=True)`. Flask's
url_for uses request.scheme from the WSGI environ. When the TLS-terminating
reverse proxy forwards the request as HTTP to the backend, wsgi.url_scheme is
`http`, producing an `http://` redirect URI that mismatches the EntraID app
registration's `https://` redirect URI.
## Fix
Override `login` in `CustomAuthOAuthView` (which already customizes the
parent for Airflow) to check `X-Forwarded-Proto` and update the WSGI environ
scheme before delegating to the parent. This works as a defense-in-depth
measure:
- If ProxyFix is already correcting the scheme -> the environ already says
`https`, so this is a no-op
- If ProxyFix is not configured or not working -> `X-Forwarded-Proto: https`
from the reverse proxy forces the correct scheme
## Related issues
Fixes #70023
## Testing
- Existing tests pass
- ruff check and ruff format pass on the modified file
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
