Repository navigation
[v3-4-test] Keep extra cookies set by a route in JWTRefreshMiddleware - #75869
Merged
Merged
Conversation
Member
Author
|
Following Rahul instruction, keep in draft |
…ed or yanked (apache#75919) (apache#75924) Constraints for an Airflow release candidate pin the provider wave being voted on at its rc versions, and commit them onto the shared constraints-X-Y branch. The next regular generation for the vX-Y-test branch resolves without pre-releases, so it saw the older finals as a provider downgrade and failed - the v3-4-test canary has been red since 3.4.0rc1 for exactly that reason, although nothing was yanked. The final release has the opposite gap: it ignored the candidates, so a provider rc that was neither released nor yanked was silently passed over and the released constraints never recorded that decision. It now has to be made, and the run says which providers it is still waiting on. The alert that should have reported the canary failure never reached Slack because the action was not told which API method to call, and the twice-daily CI notification announced "All passing" because it read a run that was still in progress, whose missing conclusion looked like no failures. (cherry picked from commit eeae004) Generated-by: Claude Opus 5 Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
…esh_middleware() (apache#70783) Co-authored-by: Stephen Bracken <email-protected> (cherry picked from commit e5d8cbb)
* Keep extra cookies set by a route in JWTRefreshMiddleware The route-wins rule only covered the token cookie, so a cookie returned by get_extra_cookies was still appended after the same cookie set by the route. When the session was invalidated, that cleared the cookie a login callback had just issued. The generate_new_user_token test passed one-element tuples to a single parametrized argument, so the case without a new user never ran. * Split token and cleanup cookie handling in JWTRefreshMiddleware * Let route cookies win by sending the middleware cookies first Browsers key cookies on name and path, so matching the route's cookies by name alone dropped our clear when the route set the same name on another path. Sending our headers before the route's lets the later Set-Cookie win for the same name and path, without parsing them. * Never send a refreshed token when the route sets its own Sending the refreshed token first and letting the route's logout cookie override it still put a freshly minted, unrevoked JWT on the wire, and clients such as Python's http.cookiejar keep it because they don't apply Set-Cookie headers in order. (cherry picked from commit ea2aae7)
shahar1
force-pushed
the
backport-75411
branch
from
October 29, 2026 07:39
5f17d03 to
e526588
Compare
shahar1
marked this pull request as ready for review
October 29, 2026 07:45
shahar1
requested review from
bugraoz93,
choo121600,
ephraimbuddy,
henry3260,
jason810496,
rawwar,
shubhamraj-git and
vincbeck
as code owners
October 29, 2026 07:45
shahar1
marked this pull request as draft
October 29, 2026 07:45
shahar1
marked this pull request as ready for review
October 30, 2026 05:51
shahar1
marked this pull request as draft
October 30, 2026 05:51
vatsrahul1001
force-pushed
the
v3-4-test
branch
2 times, most recently
from
November 4, 2026 09:12
10eae22 to
e63e6bb
Compare
shahar1
marked this pull request as ready for review
November 6, 2026 07:27
shahar1
requested review from
amoghrajesh,
ashb,
gopidesupavan,
jedcunningham,
jscheffl,
potiuk,
shahar1 and
vatsrahul1001
as code owners
November 6, 2026 07:27
shahar1
approved these changes
Nov 6, 2026
shahar1
enabled auto-merge (squash)
November 6, 2026 08:36
shahar1
disabled auto-merge
November 6, 2026 09:09
shahar1
enabled auto-merge (squash)
November 6, 2026 09:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #75411 to
v3-4-test.Cherry-picked from ea2aae7. Clean cherry-pick, no conflicts.
The automatic backport failed because #75411 builds on #70783, which wasn't on
v3-4-test. This PR is stacked on #75868 (the backport of #70783). Until that one merges, the diff here also shows its commit, so please merge #75868 first.Was generative AI tooling used to co-author this PR?
Generated-by: Claude Code (Opus 5.5) following the guidelines