Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove user sessions when resetting password #33347

Merged
merged 2 commits into from
Aug 13, 2023
Merged

Remove user sessions when resetting password #33347

merged 2 commits into from
Aug 13, 2023
+181 −2

Commits on Aug 13, 2023

  1. Remove user sessions when resetting password 

    When user's password is reset, we also remove all DB sessions
for that user - for database session backend.

In case we are using securecookie mechanism, resetting password does
not invalidate old sessions, so instead we are displaying warning to
the user performing the reset that in order to clear existing
sessions of the user, the secure_key needs to be changed and it
will invalidate all sessions for all users.

Protection has been added in case the number of sessions in the DB
is too big to effectively scan and remove sessions for the user. In
such case we print warning for the user that sessions have not
been reset, and we suggest to improve the way their deployment
mechanisms create too many sessions - by either changing the way
how automation of the API calls is done and/or by purging the
sessions regularly by "airflow db clean".
    @potiuk
    potiuk committed Aug 13, 2023
    Configuration menu
    Copy the full SHA
    10c5e4e View commit details
    Browse the repository at this point in the history

  2. Update airflow/auth/managers/fab/security_manager/override.py 

    Co-authored-by: Hussein Awala <hussein@awala.fr>
    @potiuk @hussein-awala
    potiuk and hussein-awala authored Aug 13, 2023
    Configuration menu
    Copy the full SHA
    0efae25 View commit details
    Browse the repository at this point in the history