stegololz opened a new pull request, #71506: URL: https://github.com/apache/airflow/pull/71506
related: #71077, #70800 #71077 fixed the `_token` cookie getting cleared in `/login_callback` when the request carries no token. The same bug still happens when the request carries an expired token: a user re-logging in after their Airflow JWT expired (default 24h) still has the stale cookie in the browser. `KeycloakJWTMiddleware` fails to validate it, marks the cookie for clearing, and appends `Set-Cookie: _token=""` after the fresh token the callback just set. The browser applies the deletion last, so every login dies in the response that created it and the user loops back to the login page indefinitely. Fix: the login callback signals via `request.state.jwt_token_issued` that the response carries a freshly issued JWT, and the middleware skips the cookie clear in that case. This is the same request-scoped signaling the middleware already uses for `request.state.user`. The flag needs no reset: `request.state` is per-request scratch space, born absent (read as `False`) and discarded with the request. Added a regression test: an invalid token on the request plus an endpoint that issues a fresh JWT must not produce a clearing cookie. ##### Was generative AI tooling used to co-author this PR? - [X] Yes (Claude Code) - [ ] No -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
