Revoke JWT on /auth/logout regardless of auth manager logout URL - #67289

Merged
pierrejeambrun merged 1 commit into
apache:mainfrom
astronomer:fix-logout-revoke-token
May 22, 2026
Merged

Revoke JWT on /auth/logout regardless of auth manager logout URL#67289
pierrejeambrun merged 1 commit into
apache:mainfrom
astronomer:fix-logout-revoke-token

Conversation

@pierrejeambrun

@pierrejeambrunpierrejeambrun commented May 21, 2026•
edited
Loading

Copy link
Copy Markdown
Member

The /auth/logout endpoint previously short-circuited via early return when an auth manager's get_url_logout() returned a URL, and auth_manager.revoke_token(token_str) was never called.

Move the revoke_token call before the early return so logout reliably invalidates the JWT token regardless of which auth manager is configured. Both branches are covered by tests:

  • test_logout_revokes_token — get_url_logout() returns None (existing test).
  • test_logout_revokes_token_when_logout_url_redirects — get_url_logout() returns a URL (new test).
Was generative AI tooling used to co-author this PR?
  • Yes — Claude Code (Opus 4.7)

Generated-by: Claude Code (Opus 4.7) following the guidelines

@boring-cyborgboring-cyborgBot added the area:API Airflow's REST/HTTP API label May 21, 2026
@pierrejeambrunpierrejeambrun self-assigned this May 21, 2026
@pierrejeambrun
pierrejeambrun marked this pull request as ready for review May 21, 2026 16:22
@pierrejeambrun
Revoke JWT on /auth/logout regardless of auth manager logout URL
4fecf73
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
@pierrejeambrun
pierrejeambrunforce-pushed the fix-logout-revoke-token branch from 38daa2f to 4fecf73CompareMay 22, 2026 09:13
@pierrejeambrun
pierrejeambrun merged commit b1aec75 into apache:mainMay 22, 2026
143 checks passed
@pierrejeambrun
pierrejeambrun deleted the fix-logout-revoke-token branch May 22, 2026 22:45
@github-actions

github-actionsBot commented May 22, 2026

Copy link
Copy Markdown
Contributor

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

StatusBranchResult
✅v3-2-testPR Link

github-actionsBot pushed a commit to aws-mwaa/upstream-to-airflow that referenced this pull request May 22, 2026
@pierrejeambrunYour friendly bot
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
3220af5
…out URL (apache#67289)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
aws-airflow-bot pushed a commit to aws-mwaa/upstream-to-airflow that referenced this pull request May 22, 2026
@pierrejeambrunYour friendly bot
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
6eb4d19
…out URL (apache#67289)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
jason810496 pushed a commit that referenced this pull request May 23, 2026
@github-actions@pierrejeambrun
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
ef5787b
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
@potiukpotiuk mentioned this pull request May 24, 2026
Merged
1 task
vatsrahul1001 pushed a commit that referenced this pull request May 25, 2026
@github-actions@pierrejeambrun@vatsrahul1001
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
630be6f
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
vatsrahul1001 pushed a commit that referenced this pull request May 25, 2026
@github-actions@pierrejeambrun@vatsrahul1001
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
31e4144
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
@nixpkgs-security-trackernixpkgs-security-trackerBot mentioned this pull request Jun 2, 2026
Closed
@securylightsecurylight mentioned this pull request Jul 28, 2026
Open
3 tasks
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@eladkaleladkaleladkal approved these changes
@jscheffljscheffljscheffl approved these changes
@vincbeckvincbeckvincbeck approved these changes
@ephraimbuddyephraimbuddyAwaiting requested review from ephraimbuddyephraimbuddy is a code owner
@rawwarrawwarAwaiting requested review from rawwarrawwar is a code owner
@jason810496jason810496Awaiting requested review from jason810496jason810496 is a code owner
@bugraoz93bugraoz93Awaiting requested review from bugraoz93bugraoz93 is a code owner
@shubhamraj-gitshubhamraj-gitAwaiting requested review from shubhamraj-gitshubhamraj-git is a code owner
@choo121600choo121600Awaiting requested review from choo121600choo121600 is a code owner

Assignees

@pierrejeambrunpierrejeambrun

Labels

area:APIAirflow's REST/HTTP API

Projects

None yet

Milestone

Airflow 3.2.2

Development

Successfully merging this pull request may close these issues.

4 participants

@pierrejeambrun@eladkal@jscheffl@vincbeck
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Revoke JWT on /auth/logout regardless of auth manager logout URL - #67289
Merged
pierrejeambrun merged 1 commit into
apache:mainfrom 
astronomer:fix-logout-revoke-token
May 22, 2026
Merged
Revoke JWT on /auth/logout regardless of auth manager logout URL#67289
pierrejeambrun merged 1 commit into
apache:mainfrom 
astronomer:fix-logout-revoke-token
Conversation
@pierrejeambrun
@pierrejeambrunpierrejeambrun
commented
May 21, 2026•

edited

Loading

Copy link


Copy Markdown

Member
The /auth/logout endpoint previously short-circuited via early return when an auth manager's get_url_logout() returned a URL, and auth_manager.revoke_token(token_str) was never called.
Move the revoke_token call before the early return so logout reliably invalidates the JWT token regardless of which auth manager is configured. Both branches are covered by tests:
  • test_logout_revokes_token — get_url_logout() returns None (existing test).
  • test_logout_revokes_token_when_logout_url_redirects — get_url_logout() returns a URL (new test).
Was generative AI tooling used to co-author this PR?
  •  Yes — Claude Code (Opus 4.7)
Generated-by: Claude Code (Opus 4.7) following the guidelines
@boring-cyborgboring-cyborgBot
added
the 
area:API
Airflow's REST/HTTP API
label
May 21, 2026
@pierrejeambrunpierrejeambrun
self-assigned this
May 21, 2026
@pierrejeambrun
pierrejeambrun
marked this pull request as ready for review
May 21, 2026 16:22
@pierrejeambrun
Revoke JWT on /auth/logout regardless of auth manager logout URL
4fecf73
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
@pierrejeambrun
pierrejeambrunforce-pushed
the
fix-logout-revoke-token
branch
from
38daa2f to
4fecf73CompareMay 22, 2026 09:13
@pierrejeambrun
pierrejeambrun
merged commit b1aec75
into
apache:mainMay 22, 2026

143 checks passed

@pierrejeambrun
pierrejeambrun
deleted the

fix-logout-revoke-token

branch
May 22, 2026 22:45
@github-actions
github-actionsBot
commented
May 22, 2026

Copy link


Copy Markdown

Contributor
Backport successfully created: v3-2-test
Note: As of Merging PRs targeted for Airflow 3.X

the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.
In matter of doubt please ask in #release-management Slack channel.
StatusBranchResult
✅v3-2-testPR Link
github-actionsBot
pushed a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
May 22, 2026
@pierrejeambrunYour friendly bot
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
3220af5
…out URL (apache#67289)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
aws-airflow-bot pushed a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
May 22, 2026
@pierrejeambrunYour friendly bot
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
6eb4d19
…out URL (apache#67289)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
jason810496 pushed a commit
that referenced
this pull request
May 23, 2026
@github-actions@pierrejeambrun
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
ef5787b
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
@potiukpotiuk
mentioned this pull request
May 24, 2026
 Merged

1 task
vatsrahul1001 pushed a commit
that referenced
this pull request
May 25, 2026
@github-actions@pierrejeambrun@vatsrahul1001
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
630be6f
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
vatsrahul1001 pushed a commit
that referenced
this pull request
May 25, 2026
@github-actions@pierrejeambrun@vatsrahul1001
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
31e4144
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
@nixpkgs-security-trackernixpkgs-security-trackerBot
mentioned this pull request
Jun 2, 2026

Closed

@securylightsecurylight
mentioned this pull request
Jul 28, 2026
 Open

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@eladkaleladkaleladkal approved these changes
@jscheffljscheffljscheffl approved these changes
@vincbeckvincbeckvincbeck approved these changes
@ephraimbuddyephraimbuddyAwaiting requested review from ephraimbuddyephraimbuddy is a code owner
@rawwarrawwarAwaiting requested review from rawwarrawwar is a code owner
@jason810496jason810496Awaiting requested review from jason810496jason810496 is a code owner
@bugraoz93bugraoz93Awaiting requested review from bugraoz93bugraoz93 is a code owner
@shubhamraj-gitshubhamraj-gitAwaiting requested review from shubhamraj-gitshubhamraj-git is a code owner
@choo121600choo121600Awaiting requested review from choo121600choo121600 is a code owner

Assignees

@pierrejeambrunpierrejeambrun

Labels

area:APIAirflow's REST/HTTP API

Projects


None yet


Milestone

Airflow 3.2.2

Development

Successfully merging this pull request may close these issues.

4 participants

@pierrejeambrun@eladkal@jscheffl@vincbeck

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Revoke JWT on /auth/logout regardless of auth manager logout URL - #67289
Merged
pierrejeambrun merged 1 commit into
apache:mainfrom 
astronomer:fix-logout-revoke-token
May 22, 2026
Merged
Revoke JWT on /auth/logout regardless of auth manager logout URL#67289
pierrejeambrun merged 1 commit into
apache:mainfrom 
astronomer:fix-logout-revoke-token
Conversation
@pierrejeambrun
@pierrejeambrunpierrejeambrun
commented
May 21, 2026•

edited

Loading

Copy link


Copy Markdown

Member
The /auth/logout endpoint previously short-circuited via early return when an auth manager's get_url_logout() returned a URL, and auth_manager.revoke_token(token_str) was never called.
Move the revoke_token call before the early return so logout reliably invalidates the JWT token regardless of which auth manager is configured. Both branches are covered by tests:
  • test_logout_revokes_token — get_url_logout() returns None (existing test).
  • test_logout_revokes_token_when_logout_url_redirects — get_url_logout() returns a URL (new test).
Was generative AI tooling used to co-author this PR?
  •  Yes — Claude Code (Opus 4.7)
Generated-by: Claude Code (Opus 4.7) following the guidelines
@boring-cyborgboring-cyborgBot
added
the 
area:API
Airflow's REST/HTTP API
label
May 21, 2026
@pierrejeambrunpierrejeambrun
self-assigned this
May 21, 2026
@pierrejeambrun
pierrejeambrun
marked this pull request as ready for review
May 21, 2026 16:22
@pierrejeambrun
Revoke JWT on /auth/logout regardless of auth manager logout URL
4fecf73
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
@pierrejeambrun
pierrejeambrunforce-pushed
the
fix-logout-revoke-token
branch
from
38daa2f to
4fecf73CompareMay 22, 2026 09:13
@pierrejeambrun
pierrejeambrun
merged commit b1aec75
into
apache:mainMay 22, 2026

143 checks passed

@pierrejeambrun
pierrejeambrun
deleted the

fix-logout-revoke-token

branch
May 22, 2026 22:45
@github-actions
github-actionsBot
commented
May 22, 2026

Copy link


Copy Markdown

Contributor
Backport successfully created: v3-2-test
Note: As of Merging PRs targeted for Airflow 3.X

the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.
In matter of doubt please ask in #release-management Slack channel.
StatusBranchResult
✅v3-2-testPR Link
github-actionsBot
pushed a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
May 22, 2026
@pierrejeambrunYour friendly bot
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
3220af5
…out URL (apache#67289)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
aws-airflow-bot pushed a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
May 22, 2026
@pierrejeambrunYour friendly bot
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
6eb4d19
…out URL (apache#67289)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
jason810496 pushed a commit
that referenced
this pull request
May 23, 2026
@github-actions@pierrejeambrun
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
ef5787b
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
@potiukpotiuk
mentioned this pull request
May 24, 2026
 Merged

1 task
vatsrahul1001 pushed a commit
that referenced
this pull request
May 25, 2026
@github-actions@pierrejeambrun@vatsrahul1001
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
630be6f
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
vatsrahul1001 pushed a commit
that referenced
this pull request
May 25, 2026
@github-actions@pierrejeambrun@vatsrahul1001
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
31e4144
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
@nixpkgs-security-trackernixpkgs-security-trackerBot
mentioned this pull request
Jun 2, 2026

Closed

@securylightsecurylight
mentioned this pull request
Jul 28, 2026
 Open

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@eladkaleladkaleladkal approved these changes
@jscheffljscheffljscheffl approved these changes
@vincbeckvincbeckvincbeck approved these changes
@ephraimbuddyephraimbuddyAwaiting requested review from ephraimbuddyephraimbuddy is a code owner
@rawwarrawwarAwaiting requested review from rawwarrawwar is a code owner
@jason810496jason810496Awaiting requested review from jason810496jason810496 is a code owner
@bugraoz93bugraoz93Awaiting requested review from bugraoz93bugraoz93 is a code owner
@shubhamraj-gitshubhamraj-gitAwaiting requested review from shubhamraj-gitshubhamraj-git is a code owner
@choo121600choo121600Awaiting requested review from choo121600choo121600 is a code owner

Assignees

@pierrejeambrunpierrejeambrun

Labels

area:APIAirflow's REST/HTTP API

Projects


None yet


Milestone

Airflow 3.2.2

Development

Successfully merging this pull request may close these issues.

4 participants

@pierrejeambrun@eladkal@jscheffl@vincbeck

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Revoke JWT on /auth/logout regardless of auth manager logout URL - #67289
Merged
pierrejeambrun merged 1 commit into
apache:mainfrom 
astronomer:fix-logout-revoke-token
May 22, 2026
Merged
Revoke JWT on /auth/logout regardless of auth manager logout URL#67289
pierrejeambrun merged 1 commit into
apache:mainfrom 
astronomer:fix-logout-revoke-token
Conversation
@pierrejeambrun
@pierrejeambrunpierrejeambrun
commented
May 21, 2026•

edited

Loading

Copy link


Copy Markdown

Member
The /auth/logout endpoint previously short-circuited via early return when an auth manager's get_url_logout() returned a URL, and auth_manager.revoke_token(token_str) was never called.
Move the revoke_token call before the early return so logout reliably invalidates the JWT token regardless of which auth manager is configured. Both branches are covered by tests:
  • test_logout_revokes_token — get_url_logout() returns None (existing test).
  • test_logout_revokes_token_when_logout_url_redirects — get_url_logout() returns a URL (new test).
Was generative AI tooling used to co-author this PR?
  •  Yes — Claude Code (Opus 4.7)
Generated-by: Claude Code (Opus 4.7) following the guidelines
@boring-cyborgboring-cyborgBot
added
the 
area:API
Airflow's REST/HTTP API
label
May 21, 2026
@pierrejeambrunpierrejeambrun
self-assigned this
May 21, 2026
@pierrejeambrun
pierrejeambrun
marked this pull request as ready for review
May 21, 2026 16:22
@pierrejeambrun
Revoke JWT on /auth/logout regardless of auth manager logout URL
4fecf73
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
@pierrejeambrun
pierrejeambrunforce-pushed
the
fix-logout-revoke-token
branch
from
38daa2f to
4fecf73CompareMay 22, 2026 09:13
@pierrejeambrun
pierrejeambrun
merged commit b1aec75
into
apache:mainMay 22, 2026

143 checks passed

@pierrejeambrun
pierrejeambrun
deleted the

fix-logout-revoke-token

branch
May 22, 2026 22:45
@github-actions
github-actionsBot
commented
May 22, 2026

Copy link


Copy Markdown

Contributor
Backport successfully created: v3-2-test
Note: As of Merging PRs targeted for Airflow 3.X

the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.
In matter of doubt please ask in #release-management Slack channel.
StatusBranchResult
✅v3-2-testPR Link
github-actionsBot
pushed a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
May 22, 2026
@pierrejeambrunYour friendly bot
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
3220af5
…out URL (apache#67289)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
aws-airflow-bot pushed a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
May 22, 2026
@pierrejeambrunYour friendly bot
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
6eb4d19
…out URL (apache#67289)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
jason810496 pushed a commit
that referenced
this pull request
May 23, 2026
@github-actions@pierrejeambrun
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
ef5787b
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
@potiukpotiuk
mentioned this pull request
May 24, 2026
 Merged

1 task
vatsrahul1001 pushed a commit
that referenced
this pull request
May 25, 2026
@github-actions@pierrejeambrun@vatsrahul1001
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
630be6f
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
vatsrahul1001 pushed a commit
that referenced
this pull request
May 25, 2026
@github-actions@pierrejeambrun@vatsrahul1001
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
31e4144
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
@nixpkgs-security-trackernixpkgs-security-trackerBot
mentioned this pull request
Jun 2, 2026

Closed

@securylightsecurylight
mentioned this pull request
Jul 28, 2026
 Open

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@eladkaleladkaleladkal approved these changes
@jscheffljscheffljscheffl approved these changes
@vincbeckvincbeckvincbeck approved these changes
@ephraimbuddyephraimbuddyAwaiting requested review from ephraimbuddyephraimbuddy is a code owner
@rawwarrawwarAwaiting requested review from rawwarrawwar is a code owner
@jason810496jason810496Awaiting requested review from jason810496jason810496 is a code owner
@bugraoz93bugraoz93Awaiting requested review from bugraoz93bugraoz93 is a code owner
@shubhamraj-gitshubhamraj-gitAwaiting requested review from shubhamraj-gitshubhamraj-git is a code owner
@choo121600choo121600Awaiting requested review from choo121600choo121600 is a code owner

Assignees

@pierrejeambrunpierrejeambrun

Labels

area:APIAirflow's REST/HTTP API

Projects


None yet


Milestone

Airflow 3.2.2

Development

Successfully merging this pull request may close these issues.

4 participants

@pierrejeambrun@eladkal@jscheffl@vincbeck

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Revoke JWT on /auth/logout regardless of auth manager logout URL - #67289
Merged
pierrejeambrun merged 1 commit into
apache:mainfrom 
astronomer:fix-logout-revoke-token
May 22, 2026
Merged
Revoke JWT on /auth/logout regardless of auth manager logout URL#67289
pierrejeambrun merged 1 commit into
apache:mainfrom 
astronomer:fix-logout-revoke-token
Conversation
@pierrejeambrun
@pierrejeambrunpierrejeambrun
commented
May 21, 2026•

edited

Loading

Copy link


Copy Markdown

Member
The /auth/logout endpoint previously short-circuited via early return when an auth manager's get_url_logout() returned a URL, and auth_manager.revoke_token(token_str) was never called.
Move the revoke_token call before the early return so logout reliably invalidates the JWT token regardless of which auth manager is configured. Both branches are covered by tests:
  • test_logout_revokes_token — get_url_logout() returns None (existing test).
  • test_logout_revokes_token_when_logout_url_redirects — get_url_logout() returns a URL (new test).
Was generative AI tooling used to co-author this PR?
  •  Yes — Claude Code (Opus 4.7)
Generated-by: Claude Code (Opus 4.7) following the guidelines
@boring-cyborgboring-cyborgBot
added
the 
area:API
Airflow's REST/HTTP API
label
May 21, 2026
@pierrejeambrunpierrejeambrun
self-assigned this
May 21, 2026
@pierrejeambrun
pierrejeambrun
marked this pull request as ready for review
May 21, 2026 16:22
@pierrejeambrun
Revoke JWT on /auth/logout regardless of auth manager logout URL
4fecf73
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
@pierrejeambrun
pierrejeambrunforce-pushed
the
fix-logout-revoke-token
branch
from
38daa2f to
4fecf73CompareMay 22, 2026 09:13
@pierrejeambrun
pierrejeambrun
merged commit b1aec75
into
apache:mainMay 22, 2026

143 checks passed

@pierrejeambrun
pierrejeambrun
deleted the

fix-logout-revoke-token

branch
May 22, 2026 22:45
@github-actions
github-actionsBot
commented
May 22, 2026

Copy link


Copy Markdown

Contributor
Backport successfully created: v3-2-test
Note: As of Merging PRs targeted for Airflow 3.X

the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.
In matter of doubt please ask in #release-management Slack channel.
StatusBranchResult
✅v3-2-testPR Link
github-actionsBot
pushed a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
May 22, 2026
@pierrejeambrunYour friendly bot
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
3220af5
…out URL (apache#67289)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
aws-airflow-bot pushed a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
May 22, 2026
@pierrejeambrunYour friendly bot
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
6eb4d19
…out URL (apache#67289)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
jason810496 pushed a commit
that referenced
this pull request
May 23, 2026
@github-actions@pierrejeambrun
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
ef5787b
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
@potiukpotiuk
mentioned this pull request
May 24, 2026
 Merged

1 task
vatsrahul1001 pushed a commit
that referenced
this pull request
May 25, 2026
@github-actions@pierrejeambrun@vatsrahul1001
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
630be6f
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
vatsrahul1001 pushed a commit
that referenced
this pull request
May 25, 2026
@github-actions@pierrejeambrun@vatsrahul1001
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
31e4144
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
@nixpkgs-security-trackernixpkgs-security-trackerBot
mentioned this pull request
Jun 2, 2026

Closed

@securylightsecurylight
mentioned this pull request
Jul 28, 2026
 Open

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@eladkaleladkaleladkal approved these changes
@jscheffljscheffljscheffl approved these changes
@vincbeckvincbeckvincbeck approved these changes
@ephraimbuddyephraimbuddyAwaiting requested review from ephraimbuddyephraimbuddy is a code owner
@rawwarrawwarAwaiting requested review from rawwarrawwar is a code owner
@jason810496jason810496Awaiting requested review from jason810496jason810496 is a code owner
@bugraoz93bugraoz93Awaiting requested review from bugraoz93bugraoz93 is a code owner
@shubhamraj-gitshubhamraj-gitAwaiting requested review from shubhamraj-gitshubhamraj-git is a code owner
@choo121600choo121600Awaiting requested review from choo121600choo121600 is a code owner

Assignees

@pierrejeambrunpierrejeambrun

Labels

area:APIAirflow's REST/HTTP API

Projects


None yet


Milestone

Airflow 3.2.2

Development

Successfully merging this pull request may close these issues.

4 participants

@pierrejeambrun@eladkal@jscheffl@vincbeck

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Revoke JWT on /auth/logout regardless of auth manager logout URL - #67289
Merged
pierrejeambrun merged 1 commit into
apache:mainfrom 
astronomer:fix-logout-revoke-token
May 22, 2026
Merged
Revoke JWT on /auth/logout regardless of auth manager logout URL#67289
pierrejeambrun merged 1 commit into
apache:mainfrom 
astronomer:fix-logout-revoke-token
Conversation
@pierrejeambrun
@pierrejeambrunpierrejeambrun
commented
May 21, 2026•

edited

Loading

Copy link


Copy Markdown

Member
The /auth/logout endpoint previously short-circuited via early return when an auth manager's get_url_logout() returned a URL, and auth_manager.revoke_token(token_str) was never called.
Move the revoke_token call before the early return so logout reliably invalidates the JWT token regardless of which auth manager is configured. Both branches are covered by tests:
  • test_logout_revokes_token — get_url_logout() returns None (existing test).
  • test_logout_revokes_token_when_logout_url_redirects — get_url_logout() returns a URL (new test).
Was generative AI tooling used to co-author this PR?
  •  Yes — Claude Code (Opus 4.7)
Generated-by: Claude Code (Opus 4.7) following the guidelines
@boring-cyborgboring-cyborgBot
added
the 
area:API
Airflow's REST/HTTP API
label
May 21, 2026
@pierrejeambrunpierrejeambrun
self-assigned this
May 21, 2026
@pierrejeambrun
pierrejeambrun
marked this pull request as ready for review
May 21, 2026 16:22
@pierrejeambrun
Revoke JWT on /auth/logout regardless of auth manager logout URL
4fecf73
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
@pierrejeambrun
pierrejeambrunforce-pushed
the
fix-logout-revoke-token
branch
from
38daa2f to
4fecf73CompareMay 22, 2026 09:13
@pierrejeambrun
pierrejeambrun
merged commit b1aec75
into
apache:mainMay 22, 2026

143 checks passed

@pierrejeambrun
pierrejeambrun
deleted the

fix-logout-revoke-token

branch
May 22, 2026 22:45
@github-actions
github-actionsBot
commented
May 22, 2026

Copy link


Copy Markdown

Contributor
Backport successfully created: v3-2-test
Note: As of Merging PRs targeted for Airflow 3.X

the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.
In matter of doubt please ask in #release-management Slack channel.
StatusBranchResult
✅v3-2-testPR Link
github-actionsBot
pushed a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
May 22, 2026
@pierrejeambrunYour friendly bot
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
3220af5
…out URL (apache#67289)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
aws-airflow-bot pushed a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
May 22, 2026
@pierrejeambrunYour friendly bot
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
6eb4d19
…out URL (apache#67289)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
jason810496 pushed a commit
that referenced
this pull request
May 23, 2026
@github-actions@pierrejeambrun
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
ef5787b
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
@potiukpotiuk
mentioned this pull request
May 24, 2026
 Merged

1 task
vatsrahul1001 pushed a commit
that referenced
this pull request
May 25, 2026
@github-actions@pierrejeambrun@vatsrahul1001
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
630be6f
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
vatsrahul1001 pushed a commit
that referenced
this pull request
May 25, 2026
@github-actions@pierrejeambrun@vatsrahul1001
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
31e4144
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
@nixpkgs-security-trackernixpkgs-security-trackerBot
mentioned this pull request
Jun 2, 2026

Closed

@securylightsecurylight
mentioned this pull request
Jul 28, 2026
 Open

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@eladkaleladkaleladkal approved these changes
@jscheffljscheffljscheffl approved these changes
@vincbeckvincbeckvincbeck approved these changes
@ephraimbuddyephraimbuddyAwaiting requested review from ephraimbuddyephraimbuddy is a code owner
@rawwarrawwarAwaiting requested review from rawwarrawwar is a code owner
@jason810496jason810496Awaiting requested review from jason810496jason810496 is a code owner
@bugraoz93bugraoz93Awaiting requested review from bugraoz93bugraoz93 is a code owner
@shubhamraj-gitshubhamraj-gitAwaiting requested review from shubhamraj-gitshubhamraj-git is a code owner
@choo121600choo121600Awaiting requested review from choo121600choo121600 is a code owner

Assignees

@pierrejeambrunpierrejeambrun

Labels

area:APIAirflow's REST/HTTP API

Projects


None yet


Milestone

Airflow 3.2.2

Development

Successfully merging this pull request may close these issues.

4 participants

@pierrejeambrun@eladkal@jscheffl@vincbeck

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Revoke JWT on /auth/logout regardless of auth manager logout URL - #67289
Merged
pierrejeambrun merged 1 commit into
apache:mainfrom 
astronomer:fix-logout-revoke-token
May 22, 2026
Merged
Revoke JWT on /auth/logout regardless of auth manager logout URL#67289
pierrejeambrun merged 1 commit into
apache:mainfrom 
astronomer:fix-logout-revoke-token
Conversation
@pierrejeambrun
@pierrejeambrunpierrejeambrun
commented
May 21, 2026•

edited

Loading

Copy link


Copy Markdown

Member
The /auth/logout endpoint previously short-circuited via early return when an auth manager's get_url_logout() returned a URL, and auth_manager.revoke_token(token_str) was never called.
Move the revoke_token call before the early return so logout reliably invalidates the JWT token regardless of which auth manager is configured. Both branches are covered by tests:
  • test_logout_revokes_token — get_url_logout() returns None (existing test).
  • test_logout_revokes_token_when_logout_url_redirects — get_url_logout() returns a URL (new test).
Was generative AI tooling used to co-author this PR?
  •  Yes — Claude Code (Opus 4.7)
Generated-by: Claude Code (Opus 4.7) following the guidelines
@boring-cyborgboring-cyborgBot
added
the 
area:API
Airflow's REST/HTTP API
label
May 21, 2026
@pierrejeambrunpierrejeambrun
self-assigned this
May 21, 2026
@pierrejeambrun
pierrejeambrun
marked this pull request as ready for review
May 21, 2026 16:22
@pierrejeambrun
Revoke JWT on /auth/logout regardless of auth manager logout URL
4fecf73
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
@pierrejeambrun
pierrejeambrunforce-pushed
the
fix-logout-revoke-token
branch
from
38daa2f to
4fecf73CompareMay 22, 2026 09:13
@pierrejeambrun
pierrejeambrun
merged commit b1aec75
into
apache:mainMay 22, 2026

143 checks passed

@pierrejeambrun
pierrejeambrun
deleted the

fix-logout-revoke-token

branch
May 22, 2026 22:45
@github-actions
github-actionsBot
commented
May 22, 2026

Copy link


Copy Markdown

Contributor
Backport successfully created: v3-2-test
Note: As of Merging PRs targeted for Airflow 3.X

the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.
In matter of doubt please ask in #release-management Slack channel.
StatusBranchResult
✅v3-2-testPR Link
github-actionsBot
pushed a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
May 22, 2026
@pierrejeambrunYour friendly bot
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
3220af5
…out URL (apache#67289)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
aws-airflow-bot pushed a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
May 22, 2026
@pierrejeambrunYour friendly bot
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
6eb4d19
…out URL (apache#67289)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
jason810496 pushed a commit
that referenced
this pull request
May 23, 2026
@github-actions@pierrejeambrun
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
ef5787b
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
@potiukpotiuk
mentioned this pull request
May 24, 2026
 Merged

1 task
vatsrahul1001 pushed a commit
that referenced
this pull request
May 25, 2026
@github-actions@pierrejeambrun@vatsrahul1001
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
630be6f
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
vatsrahul1001 pushed a commit
that referenced
this pull request
May 25, 2026
@github-actions@pierrejeambrun@vatsrahul1001
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
31e4144
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
@nixpkgs-security-trackernixpkgs-security-trackerBot
mentioned this pull request
Jun 2, 2026

Closed

@securylightsecurylight
mentioned this pull request
Jul 28, 2026
 Open

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@eladkaleladkaleladkal approved these changes
@jscheffljscheffljscheffl approved these changes
@vincbeckvincbeckvincbeck approved these changes
@ephraimbuddyephraimbuddyAwaiting requested review from ephraimbuddyephraimbuddy is a code owner
@rawwarrawwarAwaiting requested review from rawwarrawwar is a code owner
@jason810496jason810496Awaiting requested review from jason810496jason810496 is a code owner
@bugraoz93bugraoz93Awaiting requested review from bugraoz93bugraoz93 is a code owner
@shubhamraj-gitshubhamraj-gitAwaiting requested review from shubhamraj-gitshubhamraj-git is a code owner
@choo121600choo121600Awaiting requested review from choo121600choo121600 is a code owner

Assignees

@pierrejeambrunpierrejeambrun

Labels

area:APIAirflow's REST/HTTP API

Projects


None yet


Milestone

Airflow 3.2.2

Development

Successfully merging this pull request may close these issues.

4 participants

@pierrejeambrun@eladkal@jscheffl@vincbeck

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Revoke JWT on /auth/logout regardless of auth manager logout URL - #67289
Merged
pierrejeambrun merged 1 commit into
apache:mainfrom 
astronomer:fix-logout-revoke-token
May 22, 2026
Merged
Revoke JWT on /auth/logout regardless of auth manager logout URL#67289
pierrejeambrun merged 1 commit into
apache:mainfrom 
astronomer:fix-logout-revoke-token
Conversation
@pierrejeambrun
@pierrejeambrunpierrejeambrun
commented
May 21, 2026•

edited

Loading

Copy link


Copy Markdown

Member
The /auth/logout endpoint previously short-circuited via early return when an auth manager's get_url_logout() returned a URL, and auth_manager.revoke_token(token_str) was never called.
Move the revoke_token call before the early return so logout reliably invalidates the JWT token regardless of which auth manager is configured. Both branches are covered by tests:
  • test_logout_revokes_token — get_url_logout() returns None (existing test).
  • test_logout_revokes_token_when_logout_url_redirects — get_url_logout() returns a URL (new test).
Was generative AI tooling used to co-author this PR?
  •  Yes — Claude Code (Opus 4.7)
Generated-by: Claude Code (Opus 4.7) following the guidelines
@boring-cyborgboring-cyborgBot
added
the 
area:API
Airflow's REST/HTTP API
label
May 21, 2026
@pierrejeambrunpierrejeambrun
self-assigned this
May 21, 2026
@pierrejeambrun
pierrejeambrun
marked this pull request as ready for review
May 21, 2026 16:22
@pierrejeambrun
Revoke JWT on /auth/logout regardless of auth manager logout URL
4fecf73
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
@pierrejeambrun
pierrejeambrunforce-pushed
the
fix-logout-revoke-token
branch
from
38daa2f to
4fecf73CompareMay 22, 2026 09:13
@pierrejeambrun
pierrejeambrun
merged commit b1aec75
into
apache:mainMay 22, 2026

143 checks passed

@pierrejeambrun
pierrejeambrun
deleted the

fix-logout-revoke-token

branch
May 22, 2026 22:45
@github-actions
github-actionsBot
commented
May 22, 2026

Copy link


Copy Markdown

Contributor
Backport successfully created: v3-2-test
Note: As of Merging PRs targeted for Airflow 3.X

the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.
In matter of doubt please ask in #release-management Slack channel.
StatusBranchResult
✅v3-2-testPR Link
github-actionsBot
pushed a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
May 22, 2026
@pierrejeambrunYour friendly bot
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
3220af5
…out URL (apache#67289)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
aws-airflow-bot pushed a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
May 22, 2026
@pierrejeambrunYour friendly bot
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
6eb4d19
…out URL (apache#67289)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
jason810496 pushed a commit
that referenced
this pull request
May 23, 2026
@github-actions@pierrejeambrun
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
ef5787b
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
@potiukpotiuk
mentioned this pull request
May 24, 2026
 Merged

1 task
vatsrahul1001 pushed a commit
that referenced
this pull request
May 25, 2026
@github-actions@pierrejeambrun@vatsrahul1001
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
630be6f
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
vatsrahul1001 pushed a commit
that referenced
this pull request
May 25, 2026
@github-actions@pierrejeambrun@vatsrahul1001
[v3-2-test] Revoke JWT on /auth/logout regardless of auth manager log…
31e4144
…out URL (#67289) (#67362)
Previously, when an auth manager's get_url_logout() returned a URL, the
/auth/logout endpoint short-circuited via early return and never invoked
auth_manager.revoke_token(token_str). The JWT therefore remained valid
after logout for auth managers like FabAuthManager and KeycloakAuthManager
that redirect to an external logout URL.
Move the revoke_token call before the early return so logout reliably
invalidates the JWT token regardless of which auth manager is configured.
(cherry picked from commit b1aec75)
Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com>
@nixpkgs-security-trackernixpkgs-security-trackerBot
mentioned this pull request
Jun 2, 2026

Closed

@securylightsecurylight
mentioned this pull request
Jul 28, 2026
 Open

3 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@eladkaleladkaleladkal approved these changes
@jscheffljscheffljscheffl approved these changes
@vincbeckvincbeckvincbeck approved these changes
@ephraimbuddyephraimbuddyAwaiting requested review from ephraimbuddyephraimbuddy is a code owner
@rawwarrawwarAwaiting requested review from rawwarrawwar is a code owner
@jason810496jason810496Awaiting requested review from jason810496jason810496 is a code owner
@bugraoz93bugraoz93Awaiting requested review from bugraoz93bugraoz93 is a code owner
@shubhamraj-gitshubhamraj-gitAwaiting requested review from shubhamraj-gitshubhamraj-git is a code owner
@choo121600choo121600Awaiting requested review from choo121600choo121600 is a code owner

Assignees

@pierrejeambrunpierrejeambrun

Labels

area:APIAirflow's REST/HTTP API

Projects


None yet


Milestone

Airflow 3.2.2

Development

Successfully merging this pull request may close these issues.

4 participants

@pierrejeambrun@eladkal@jscheffl@vincbeck