dabla opened a new pull request, #76353: URL: https://github.com/apache/airflow/pull/76353
Since Airflow 3.3 the browser JWT no longer carries the Keycloak tokens: `KeycloakJWTMiddleware` reads them from their own cookies. When it cannot (the Keycloak refresh token expired, or the access token cookie is missing), the request still reaches the route, `get_user` falls back to `resolve_user_from_token(<Airflow JWT cookie>)`, and `KeycloakAuthManager.get_user_from_token` returned `None`. The `is_authorized_*` checks then fail on `user.access_token` and every request answers 500. Because the request ends in an exception, the middleware never clears the session cookie either, so the user stays stuck until they delete the cookies by hand. `get_user_from_token` now raises `InvalidTokenError` in that case, as `BaseAuthManager.get_user_from_token` promises, and gets the matching return annotation. `resolve_user_from_token` turns it into 403 "Invalid JWT token", which the UI already handles by redirecting to the login page, and the middleware clears the session cookie on the response. Only the path without Keycloak tokens changes. Tokens minted for API clients still carry the Keycloak JWTs in their claims and are unaffected, and so are Airflow versions before 3.3. Tests: the two tests that asserted `None` now expect `InvalidTokenError` (`test_browser_token_without_cookies_is_not_authenticated` is renamed to `test_browser_token_without_cookies_is_rejected`), and a new test goes through `resolve_user_from_token` and asserts the 403 the UI relies on. All three fail without the fix. closes: #76352 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5.5) Generated-by: Claude Code (Opus 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
