robertpofuk commented on code in PR #72262:
URL: https://github.com/apache/airflow/pull/72262#discussion_r3980292732
##########
providers/edge3/src/airflow/providers/edge3/worker_api/auth.py:
##########
@@ -59,17 +108,31 @@ def _forbidden_response(message: str):
)
+def _check_method_claim(method: str, payload: dict) -> None:
+ """
+ Verify the signed ``method`` claim for shared-secret tokens.
+
+ Tokens minted by the Edge API carry the request ``method`` they are valid
+ for. Tokens issued by an external OIDC provider do not, so the check is
+ skipped when OIDC verification is enabled.
+ """
+ if _trusted_jwks_url():
Review Comment:
Addressed the issuer bit differently on purpose: my IdP doesn't provide
`iss` or
other identifiable info, so I bind identity in a custom `jwt_verifier`
instead. When
`jwt_issuer` is empty a `jwt_verifier` is required, so some authorization is
always
there. Happy to add more fixed checks, but I'd keep `jwt_verifier`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
