github-actions[bot] opened a new pull request, #75454:
URL: https://github.com/apache/airflow/pull/75454
JWTRefreshMiddleware appends its own _token Set-Cookie after the
response headers. When the route itself sets _token, the browser
applies the middleware cookie last, so it overrides the route:
- A login route, e.g. an auth manager callback mounted under /auth,
sets a fresh token while the request still carries an expired or
invalid one. The middleware appends a deletion and the user is
logged out right after logging in.
- /api/v2/auth/logout deletes the cookie, but if refresh_user returned
a refreshed user for that request the middleware appends a newly
minted, unrevoked token and the user stays logged in.
Skip the middleware token cookie when the response already sets
_token. Stale root-path cookies are still cleared.
(cherry picked from commit 99eff4608f9a63874bf6f0efda845abeaa91d2d1)
Co-authored-by: Mathieu Monet <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
