potiuk commented on PR #74529: URL: https://github.com/apache/airflow/pull/74529#issuecomment-6094708139
Thanks for catching this. It's my regression from #73698. `SameSite=None` doesn't weaken what #73698 added. The cookie is still HttpOnly and HMAC-signed, and the callback still requires `InResponseTo` to match an entry in it. `Lax` was only an extra layer on top of that binding, and it can't work with an IdP on another site. One gap remains. `_is_secure_request()` only checks `request.base_url.scheme` and `[api] ssl_cert`. The common AWS setup terminates TLS at an ALB in front of the API server. Unless the server runs with `--proxy-headers` and `FORWARDED_ALLOW_IPS`, it sees plain http, the cookie stays `Lax`, and Identity Center logins still fail with the 401. Since amazon is waiting on this for its rc2, I'm pushing a docs fixup to your branch. It adds a note to the Identity Center setup page about this requirement and links to the core "Running Airflow behind a reverse proxy" guide. Then I'll mark the PR ready, rebase it, and merge once CI is green. --- Drafted-by: Claude Code (Opus 5.5); reviewed by @potiuk before posting -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
