Lee-W commented on code in PR #75056: URL: https://github.com/apache/airflow/pull/75056#discussion_r4311848223
########## airflow-core/docs/howto/run-behind-proxy.rst: ########## @@ -70,6 +70,37 @@ To do so, you need to set the following setting in your ``airflow.cfg``:: - Please make sure your proxy does not enforce http-only status on the Set-Cookie headers. Airflow frontend needs to access the cookies through javascript, and a http-only flag would disturb this functionality. +Running multiple Airflow instances on the same host +--------------------------------------------------- + +If you serve several Airflow instances from the same host name (for example ``https://lab.mycompany.com``, +or ``localhost`` on different ports), give each instance its own path in ``[api] base_url``. Browsers scope +cookies by host name and path, not by port, so instances that share the same ``base_url`` path also share +the authentication cookie: logging in to one instance logs you out of the others. + +Airflow scopes its authentication cookie to the ``base_url`` path since Airflow 3.1.8. With the FAB, +Keycloak or AWS auth manager, this also requires ``apache-airflow-providers-fab`` 3.5.0, +``apache-airflow-providers-keycloak`` 0.6.0 or ``apache-airflow-providers-amazon`` 9.23.0 or later. +For example:: + + # instance serving production + base_url = https://lab.mycompany.com/prod + + # instance serving development + base_url = https://lab.mycompany.com/dev + +Paths that share a prefix, such as ``/airflow`` and ``/airflow_dev``, are fine: the cookie path always +ends with ``/``, so the cookie of one instance is not sent to the other. + +.. warning:: + + Do not serve one instance at the root path (``/``) while other instances on the same host name use Review Comment: nit: We could say the `base_url` path of one instance must not be a prefix of another's. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
