airflow-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Craig Forster (JIRA)" <>
Subject [jira] [Commented] (AIRFLOW-2866) Missing CSRF Token Error on Web UI Create/Update Operations
Date Fri, 10 Aug 2018 18:49:00 GMT


Craig Forster commented on AIRFLOW-2866:

[~TaoFeng] Running locally with that branch seems to fix things. I can toggle the on/off state
for a DAG without the callbacks being rejected for CSRF errors.  This is for a single web
server instance only.


I don't believe this will resolve the issue for a cluster of webservers serving requests in
a round-robin fashion, though.  Each webserver instance will still have a different secret
key and reject CSRF tokens from other cluster members.

> Missing CSRF Token Error on Web UI Create/Update Operations
> -----------------------------------------------------------
>                 Key: AIRFLOW-2866
>                 URL:
>             Project: Apache Airflow
>          Issue Type: Bug
>          Components: webapp
>            Reporter: Jasper Kahn
>            Priority: Major
> Attempting to modify or delete many resources (such as Connections or Users) results
in a 400 from the webserver:
> {quote}{{Bad Request}}
> {{The CSRF session token is missing.}}{quote}
> Logs report:
> {quote}{{[2018-08-07 18:45:15,771] \{} INFO - The CSRF session token is missing.}}
> {{ - - [07/Aug/2018:18:45:15 +0000] "POST /admin/connection/delete/ HTTP/1.1"
400 150 "http://localhost:8081/admin/connection/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36"}}{quote}
> Chrome dev tools show the CSRF token is present in the request payload.

This message was sent by Atlassian JIRA

View raw message