potiuk opened a new issue, #73303: URL: https://github.com/apache/airflow/issues/73303
### Description The Execution API issues a JWT to a running task and will reissue it on refresh for as long as the token presented is still valid. The reissue path is not bound to the lifecycle of the task instance the token was minted for, so a token can continue to be renewed after the task instance it belongs to has reached a terminal state. This is a robustness gap rather than a privilege issue: the token carries no more authority than the task already had, and `docs/security/workload.rst` and `docs/security/security_model.rst` (updated in #72172) describe the trust boundary this sits inside. The improvement is simply that a credential minted for a unit of work should stop being renewable once that unit of work is over. ### Suggested shape On reissue, check that the task instance referenced by the token's claims is still in a non-terminal state, and decline the refresh otherwise. Existing tokens keep working until they expire, so the change is backward compatible within one token lifetime. ### Context Raised while reviewing the documentation change in #72172. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
