Logging out from Web UI raises Airflow 405 error about airflow HOT 8 CLOSED

This is a bug/incompatibility in the new FAB provider 1.2.0 after implementing #40145 - seems that Airflow 2.9.2 (and before) is not compatible with the new POST-only requirement of FAB provider.

This is a problem only if you do not use constraints (that's what highly recommended in https://airflow.apache.org/docs/apache-airflow/stable/installation/installing-from-pypi.html ) - if you do not want to use constraints, you should downgrade/pin apache-airflow-providers-fab to 1.1.1 and it should fix your problem. That's a quick workaround for now until we fix it.

CC: @shahar1 : we need to find a good solution for back-compatibility - and I am not sure if we can do it for earlier Airflow versions - because Airlfow 2.9.2 and below will call the "/logout" method via GET and without CSRF. I think what we should do is to add a back-compatibilty code in logout - and allow "GET" method if airflow version <= 2.9.2

from airflow.

Glad it worked, but I will re-open it - this one is really a bug in FAB provider that we need to fix :). You SHOULD be able to use 1.2.0 providers with earlier versions of Airlfow - so likely 1.2.1 version of FAB provider will have a compatibility code to handle it.

from airflow.

CC: @shahar1 : we need to find a good solution for back-compatibility - and I am not sure if we can do it for earlier Airflow versions - because Airlfow 2.9.2 and below will call the "/logout" method via GET and without CSRF. I think what we should do is to add a back-compatibilty code in logout - and allow "GET" method if airflow version <= 2.9.2

since fab provider has min version of Airflow 2.9.0 I think the simplest solution is to bump the min version to 2.9.2
I think that is reasonable enough

from airflow.

since fab provider has min version of Airflow 2.9.0 I think the simplest solution is to bump the min version to 2.9.2
I think that is reasonable enough

There is a good reason why we should not limit it. The idea behind FAB provider is that each version is linked to a specific FAB version - because we partially vendored in security manager - and this allowed people to upgrade to newer version of fab (and security fixes it brings) without bringing Airlfow version up. So yeah - in this case it's just 2.9.1 and 2.9.2 that are affected, so once we release 2.9.3 everyone should upgrade anyway, but in general cases I think it's good to keep min Airflow version as low as we can, to allow everyone to upgrade FAB independently.

So I treat that also as a "learning" exercice on how we can do it - this way in the future we might remember to look at those compatibilities and fix them in similar way.

from airflow.

Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.

from airflow.

@potiuk, I'm aware about the the use of constraints, but I have to comply with other constraints too. I followed your recommendation & downgraded fab provider using pip install apache-airflow-providers-fab==1.1.1
and it worked !! thank you ;)

from airflow.

CC: @shahar1 : we need to find a good solution for back-compatibility - and I am not sure if we can do it for earlier Airflow versions - because Airlfow 2.9.2 and below will call the "/logout" method via GET and without CSRF. I think what we should do is to add a back-compatibilty code in logout - and allow "GET" method if airflow version <= 2.9.2

since fab provider has min version of Airflow 2.9.0 I think the simplest solution is to bump the min version to 2.9.2 I think that is reasonable enough

I just thought about it while implementing the solution 😅
It is ready, though, so it's up to you how to proceed.

from airflow.

Since you already implemented the solution and it's seems simple enough then we can just merge it :)

from airflow.