rjgoyln opened a new pull request, #71429: URL: https://github.com/apache/airflow/pull/71429
## Summary Running behind a TLS-terminating proxy is documented as `--proxy-headers` plus `FORWARDED_ALLOW_IPS` to name which proxies may be trusted, and that is what `server_type = uvicorn` does. `server_type = gunicorn` forced the trust list to `"*"`, so an operator who narrowed it to their own proxy silently got a server accepting `X-Forwarded-*` from anyone able to reach it directly — including the `X-Forwarded-Proto` that decides whether session cookies carry the `Secure` attribute. Leaving the option unset lets gunicorn read `FORWARDED_ALLOW_IPS` the same way uvicorn already does. `--proxy-headers` had no other effect under gunicorn, since `UvicornWorker` leaves uvicorn's `proxy_headers` at its default of `True`. Turning the flag off now trusts nobody, which is what it already meant for uvicorn. ## Behavior change A gunicorn deployment whose proxy is not on the API server's host and which never set `FORWARDED_ALLOW_IPS` was relying on the implicit `"*"` and needs to set it. ## Note on #47878 That issue's audit closes with "For uvicorn, ther's no `forwarded_allow_ips` which is probably a gap". Read the other way round, uvicorn already matches `run-behind-proxy.rst` and the hardcoded `"*"` is the anomaly. Every cookie site the audit lists now uses the proxy-aware `secure = ...` expression, so this is the last behavioural item on it. related: #47878 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5) Generated-by: Claude Code (Opus 5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
