Versions Affected: <1.10.11

Description:
The previous default setting for Airflow's Experimental API was to allow
all API requests without authentication, but this
poses security risks to users who miss this fact.


>From Airflow 1.10.11 the default has been changed to deny all
requests by default and is documented at
https://airflow.apache.org/docs/1.10.11/security.html#api-authentication .

Note this change fixes it for new installs but existing users need to
change their config to default
`[api] auth_backend = airflow.api.auth.backend.deny_all` as mentioned in
the Updating Guide:

https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default


Credits:
Reported by Anonymous User

Reply via email to