From d5d9413f34d28c0e7e048987532ced68ef878c26 Mon Sep 17 00:00:00 2001 From: Jarek Potiuk Date: Wed, 4 Aug 2021 13:18:55 +0200 Subject: [PATCH 1/2] Improve diagnostics message when users have secret_key misconfigured Recently fixed log open-access vulnerability have caused quite a lot of questions and issues from the affected users who did not have webserver/secret_key configured for their workers (effectively leading to random value for those keys for workers) This PR explicitly explains the possible reason for the problem and encourages the user to configure their webserver's secret_key in both - workers and webserver. Related to: #17251 and a number of similar slack discussions. --- airflow/utils/log/file_task_handler.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/airflow/utils/log/file_task_handler.py b/airflow/utils/log/file_task_handler.py index 2dc9beb57b0ac..5041812ecb4e8 100644 --- a/airflow/utils/log/file_task_handler.py +++ b/airflow/utils/log/file_task_handler.py @@ -22,6 +22,7 @@ from typing import TYPE_CHECKING, Optional import httpx +from httpx import HTTPStatusError from itsdangerous import TimedJSONWebSignatureSerializer from airflow.configuration import AirflowConfigException, conf @@ -186,6 +187,11 @@ def _read(self, ti, try_number, metadata=None): ) response.encoding = "utf-8" + if response.status_code == 403: + log += "*** !!!! Please make sure that all your webservers and workers have" \ + " the same 'secret_key' configured in 'webserver' section !!!!!\n***" + log += "*** See more at https://airflow.apache.org/docs/apache-airflow/" \ + "stable/configurations-ref.html#secret-key\n***" # Check if the resource was properly fetched response.raise_for_status() From 585b6cd3633589d1c09e4361ccdcb18ca94f1a39 Mon Sep 17 00:00:00 2001 From: Jarek Potiuk Date: Wed, 4 Aug 2021 13:59:14 +0200 Subject: [PATCH 2/2] Update airflow/utils/log/file_task_handler.py Co-authored-by: Ash Berlin-Taylor --- airflow/utils/log/file_task_handler.py | 1 - 1 file changed, 1 deletion(-) diff --git a/airflow/utils/log/file_task_handler.py b/airflow/utils/log/file_task_handler.py index 5041812ecb4e8..56b9d2351c8ab 100644 --- a/airflow/utils/log/file_task_handler.py +++ b/airflow/utils/log/file_task_handler.py @@ -22,7 +22,6 @@ from typing import TYPE_CHECKING, Optional import httpx -from httpx import HTTPStatusError from itsdangerous import TimedJSONWebSignatureSerializer from airflow.configuration import AirflowConfigException, conf