bnspopi opened a new pull request, #74603: URL: https://github.com/apache/airflow/pull/74603
When Airflow runs behind a reverse proxy on a URL subpath with `[fab] enable_proxy_fix = True`, the Add / Edit / Show links on the FAB Security pages (`/auth/roles/list/`, `/auth/users/list/`) come out without the `/auth` segment, land on the React shell and bounce back to the dashboard. That is #70389. Cause: the FAB Flask app is mounted under `/auth` of the API server, so WSGI requests arrive with `SCRIPT_NAME = "<base_url path>/auth"`. Werkzeug's `ProxyFix` assigns `X-Forwarded-Prefix` to `SCRIPT_NAME` outright, so the `/auth` segment is gone and every `url_for` result drops it. Fix: wrap `ProxyFix` in two small WSGI middlewares. The outer one takes only the `/auth` mount segment out of `SCRIPT_NAME` before `ProxyFix` runs, the inner one appends it to whatever prefix `ProxyFix` left. The forwarded prefix stands in for the `base_url` path, so this gives `<forwarded prefix>/auth` whether `base_url` has a path or not. The earlier attempt (#70797) stashed the whole `SCRIPT_NAME`, which doubled the subpath when `base_url` has a path; that is the case that got it closed. With `base_url = https://example.com/myns/myrelease` and `X-Forwarded-Prefix: /myns/myrelease`: | | Add link | |---|---| | main | `/myns/myrelease/roles/add` | | #70797 | `/myns/myrelease/myns/myrelease/auth/roles/add` | | this PR | `/myns/myrelease/auth/roles/add` | The mount segment is derived from `AUTH_MANAGER_FASTAPI_APP_PREFIX` and `API_ROOT_PATH`, the same constants the API server uses to mount the auth manager app, rather than hardcoded. Tests: new `providers/fab/tests/unit/fab/www/extensions/test_init_wsgi_middlewares.py` covers the mounted and unmounted app with and without a forwarded prefix, `base_url` with and without a path, a forwarded prefix equal to the mount path, a trailing slash on the prefix, and proxy fix disabled. The file is also removed from the overlooked-tests allow-list. closes: #70389 related: #70797 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (Claude Code) Generated-by: Claude Code following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) --- * Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information. Note: commit author/co-author name and email in commits become permanently public when merged. * For fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed. * When adding dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x). * For significant user-facing changes create newsfragment: `{pr_number}.significant.rst`, in [airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments). You can add this file in a follow-up commit after the PR is created so you know the PR number. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
