Airflow 3.1.4 : Airflow configured with Simple auth manager goes in Internal Server Error

[gbonazzoli]

Apache Airflow version

3.1.4

If "Other Airflow 2/3 version" selected, which one?

No response

What happened?

I have a very simple Airflow 3.1.4 installation. It is configured with Simple auth manager.

It happens that a tab connected goes in Internal Server Error. Then it is impossible to open a new connection again.

If I open another browser (for example Safari instead of Chrome) it works. It works also opening an incognito window in Chrome.

If i close Chrome it is not sufficient to re-enter in Airflow (beside going in incognito again).

What you think should happen instead?

The tab hasn't to expire, like it did in all the previous versions.

How to reproduce

Upgrade to Airflow 3.1.4 (in my case I was running 3.1.3 before).

Operating System

Ubuntu 24.04.3 LTS

Versions of Apache Airflow Providers

apache-airflow==3.1.4
apache-airflow-core==3.1.4
apache-airflow-providers-celery==3.14.0
apache-airflow-providers-cncf-kubernetes==10.11.0
apache-airflow-providers-common-compat==1.10.0
apache-airflow-providers-common-io==1.7.0
apache-airflow-providers-common-sql==1.30.0
apache-airflow-providers-fab==3.0.3
apache-airflow-providers-git==0.1.0
apache-airflow-providers-postgres==6.5.0
apache-airflow-providers-redis==4.4.0
apache-airflow-providers-salesforce==5.12.0
apache-airflow-providers-smtp==2.4.0
apache-airflow-providers-ssh==4.2.0
apache-airflow-providers-standard==1.10.0
apache-airflow-task-sdk==1.1.4

Deployment

Virtualenv installation

Deployment details

nothing strange.

Ubuntu 24.04 & Postgres on an LXD container.

Anything else?

no

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[potiuk]

As a workaround you need to clear your cookies. We thought we fixed this (it was happening in RC1) - but apparently there is another scenario. cc: @pierrejeambrun @vincbeck @ephraimbuddy @jscheffl

[jscheffl]

Unfortunately +1 on the issue. In the process of migration we also upgraded our 3.1.3 test setup to 3.1.4 today and also got (again) a HTTP 500 - Forgot to capture the stack trace. Was OK after clearing the _token from the browser.

In RC1 I tested with SimpleAuthManager, in our test deployment used FabAuthManager - might this be a difference (just guessing for triaging?)

[aryavj1]

I, too, see the same issue for FabAuthManager in 3.1.4.

[zachliu]

yep, same FabAuthManager in 3.1.4.
i’m clearing my cookies like i’ve never cleared them before 😆

[MaluNoPeleke]

Same problem for us with 3.1.4:

[2025-12-12T10:43:47.855610Z] {base_auth_manager.py:107} ERROR - JWT token is not valid: Signature has expired
INFO:     192.168.143.2:33500 - "GET /favicon.ico HTTP/1.1" 500 Internal Server Error
ERROR:    Exception in ASGI application
  + Exception Group Traceback (most recent call last):
  |   File "/home/airflow/.local/lib/python3.12/site-packages/starlette/_utils.py", line 79, in collapse_excgroups
  |     yield
  |   File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 183, in __call__
  |     async with anyio.create_task_group() as task_group:
  |                ^^^^^^^^^^^^^^^^^^^^^^^^^
  |   File "/home/airflow/.local/lib/python3.12/site-packages/anyio/_backends/_asyncio.py", line 783, in __aexit__
  |     raise BaseExceptionGroup(
  | ExceptionGroup: unhandled errors in a TaskGroup (1 sub-exception)
  +-+---------------- 1 ----------------
    | Traceback (most recent call last):
    |   File "/home/airflow/.local/lib/python3.12/site-packages/uvicorn/protocols/http/httptools_impl.py", line 409, in run_asgi
    |     result = await app(  # type: ignore[func-returns-value]
    |              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/home/airflow/.local/lib/python3.12/site-packages/fastapi/applications.py", line 1082, in __call__
    |     await super().__call__(scope, receive, send)
    |   File "/home/airflow/.local/lib/python3.12/site-packages/starlette/applications.py", line 113, in __call__
    |     await self.middleware_stack(scope, receive, send)
    |   File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/errors.py", line 186, in __call__
    |     raise exc
    |   File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/errors.py", line 164, in __call__
    |     await self.app(scope, receive, _send)
    |   File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/gzip.py", line 29, in __call__
    |     await responder(scope, receive, send)
    |   File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/gzip.py", line 130, in __call__
    |     await super().__call__(scope, receive, send)
    |   File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/gzip.py", line 46, in __call__
    |     await self.app(scope, receive, self.send_with_compression)
    |   File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/cors.py", line 85, in __call__
    |     await self.app(scope, receive, send)
    |   File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 182, in __call__
    |     with recv_stream, send_stream, collapse_excgroups():
    |                                    ^^^^^^^^^^^^^^^^^^^^
    |   File "/usr/python/lib/python3.12/contextlib.py", line 158, in __exit__
    |     self.gen.throw(value)
    |   File "/home/airflow/.local/lib/python3.12/site-packages/starlette/_utils.py", line 85, in collapse_excgroups
    |     raise exc
    |   File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 184, in __call__
    |     response = await self.dispatch_func(request, call_next)
    |                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/home/airflow/.local/lib/python3.12/site-packages/airflow/api_fastapi/auth/middlewares/refresh_token.py", line 45, in dispatch
    |     new_user = await self._refresh_user(current_token)
    |                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/home/airflow/.local/lib/python3.12/site-packages/airflow/api_fastapi/auth/middlewares/refresh_token.py", line 67, in _refresh_user
    |     user = await resolve_user_from_token(current_token)
    |            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |   File "/home/airflow/.local/lib/python3.12/site-packages/airflow/api_fastapi/core_api/security.py", line 101, in resolve_user_from_token
    |     raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Token Expired")
    | fastapi.exceptions.HTTPException: 401: Token Expired
    +------------------------------------

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/airflow/.local/lib/python3.12/site-packages/uvicorn/protocols/http/httptools_impl.py", line 409, in run_asgi
    result = await app(  # type: ignore[func-returns-value]
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/airflow/.local/lib/python3.12/site-packages/fastapi/applications.py", line 1082, in __call__
    await super().__call__(scope, receive, send)
  File "/home/airflow/.local/lib/python3.12/site-packages/starlette/applications.py", line 113, in __call__
    await self.middleware_stack(scope, receive, send)
  File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/errors.py", line 186, in __call__
    raise exc
  File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/errors.py", line 164, in __call__
    await self.app(scope, receive, _send)
  File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/gzip.py", line 29, in __call__
    await responder(scope, receive, send)
  File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/gzip.py", line 130, in __call__
    await super().__call__(scope, receive, send)
  File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/gzip.py", line 46, in __call__
    await self.app(scope, receive, self.send_with_compression)
  File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/cors.py", line 85, in __call__
    await self.app(scope, receive, send)
  File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 182, in __call__
    with recv_stream, send_stream, collapse_excgroups():
                                   ^^^^^^^^^^^^^^^^^^^^
  File "/usr/python/lib/python3.12/contextlib.py", line 158, in __exit__
    self.gen.throw(value)
  File "/home/airflow/.local/lib/python3.12/site-packages/starlette/_utils.py", line 85, in collapse_excgroups
    raise exc
  File "/home/airflow/.local/lib/python3.12/site-packages/starlette/middleware/base.py", line 184, in __call__
    response = await self.dispatch_func(request, call_next)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/airflow/.local/lib/python3.12/site-packages/airflow/api_fastapi/auth/middlewares/refresh_token.py", line 45, in dispatch
    new_user = await self._refresh_user(current_token)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/airflow/.local/lib/python3.12/site-packages/airflow/api_fastapi/auth/middlewares/refresh_token.py", line 67, in _refresh_user
    user = await resolve_user_from_token(current_token)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/airflow/.local/lib/python3.12/site-packages/airflow/api_fastapi/core_api/security.py", line 101, in resolve_user_from_token
    raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Token Expired")

[pierrejeambrun]

🤔 My local setup is with FabAuthManager. (purposely for that scenario)

[pierrejeambrun]

I do not see #56892 as backported. (not in the release not, not in the tag logs). That might be a miss and could explain this.

[ephraimbuddy]

I do not see #56892 as backported. (not in the release not, not in the tag logs). That might be a miss and could explain this.

It's backported. Go through this commits to see it: https://github.com/apache/airflow/commits/v3-1-test/?after=ac38f6fc93610ca3a0b77193f609409296b01d42+34, also at the top commits in v3-1-stable branch

[pierrejeambrun]

@ephraimbuddy Can you double check the 3.1.4 git tag? It is backported on v3-1-test branch, but is it released?