pierrejeambrun opened a new pull request, #75411: URL: https://github.com/apache/airflow/pull/75411
Follow-up to #70783. The middleware already lets a route's own `_token` cookie win over the one it would append, but cookies returned by the new `get_extra_cookies` hook were always appended after the route's. When the session is invalidated (e.g. a login callback reached with an expired `_token`), a subclass clearing its extra cookies would wipe the ones the route had just issued: the browser applies the later `Max-Age=0` header. Nothing in-tree uses `get_extra_cookies` yet, so this closes the gap before an auth manager relies on it. The stale root-path `_token` is still cleared, since the route only sets the token on the cookie path. Also fixes `test_generate_new_user_token`: the single-argument parametrize received one-element tuples, so the case without a new user never ran. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5.5) Generated-by: Claude Code (Opus 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
