kjh0623 opened a new pull request, #70057:
URL: https://github.com/apache/airflow/pull/70057
**Problem**
`JWTRefreshMiddleware.dispatch` runs outside the FastAPI/Starlette exception
handlers, and its try/except only catches `HTTPException` and
`AuthManagerRefreshTokenExpiredException`. Any other exception raised while
resolving/refreshing the user propagates to the ASGI layer and surfaces as a
bare HTTP 500 — for a request that may not have needed the refresh at all.
The concrete way we hit this in production: PgBouncer recycles a backend
connection underneath the API server, and the next request's `_refresh_user()`
→ `resolve_user_from_token()` → user lookup raises
`sqlalchemy.exc.OperationalError` ("server closed the connection
unexpectedly"). The UI shows "Internal Server Error"; a manual refresh usually
succeeds. Related reports of the same pain point: #57859, discussion #59487.
(#62153 fixed the *poisoned-session cascade* after such a drop; this PR
addresses the request that hits the error itself.)
**Fix**
Add a final `except Exception` arm around the refresh block that treats the
failure as "could not refresh this time":
- log a warning with the traceback,
- proceed **without** injecting the user — the route's own auth dependency
revalidates the token exactly as it does today when the middleware doesn't
inject, and
- leave the cookie untouched (no forced logout), so a subsequent request
refreshes normally once the backend recovers.
`HTTPException` / token-expiry semantics are unchanged — those still clear
the cookie via the existing arm.
**Testing**
New unit test: `_refresh_user` raising a non-HTTP exception → request
completes with the downstream response, no `set-cookie` header, warning logged.
Existing middleware tests unchanged and passing.
We have been running the equivalent of this change in production (as a patch
on 3.1.8) on a deployment serving a ~3,600-DAG instance; the recurring bare
500s on the auth path disappeared.
<!-- SPDX-License-Identifier: Apache-2.0
https://www.apache.org/licenses/LICENSE-2.0 -->
---
##### Was generative AI tooling used to co-author this PR?
- [x] Yes (please specify the tool below)
Generated-by: Claude Code following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
---
* Read the **[Pull Request
Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)**
for more information. Note: commit author/co-author name and email in commits
become permanently public when merged.
* For fundamental code changes, an Airflow Improvement Proposal
([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals))
is needed.
* When adding dependency, check compliance with the [ASF 3rd Party License
Policy](https://www.apache.org/legal/resolved.html#category-x).
* For significant user-facing changes create newsfragment:
`{pr_number}.significant.rst`, in
[airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments).
You can add this file in a follow-up commit after the PR is created so you
know the PR number.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
