Skip stored credentials when a connection test overrides host or port - #69957
Merged
pierrejeambrun merged 1 commit intoJul 16, 2026
Merged
Conversation
pierrejeambrun
marked this pull request as ready for review
July 16, 2026 08:42
pierrejeambrun
requested review from
bugraoz93,
choo121600,
ephraimbuddy,
henry3260,
jason810496,
rawwar and
shubhamraj-git
as code owners
July 16, 2026 08:42
pierrejeambrun
force-pushed
the
connection-test-host-secrets
branch
from
July 16, 2026 09:28
ddb5db6 to
6b64ef2
Compare
potiuk
approved these changes
Jul 16, 2026
pierrejeambrun
force-pushed
the
connection-test-host-secrets
branch
3 times, most recently
from
July 16, 2026 13:08
72515aa to
334d65b
Compare
The POST /connections/test endpoint restores an existing connection's stored credentials (password/extra) when the request sends the masked sentinel, so a saved connection can be tested without re-typing secrets. Connection configuration users have write-only access to those credentials and are not meant to view them; reusing them while the request points at a caller-supplied host or port applies them against a destination the caller chose rather than the connection's own, which is outside the intent of the retype-free test flow. Scope the credential reuse to requests that keep the stored connection's host and port. Follows the same hardening as apache#67620.
pierrejeambrun
force-pushed
the
connection-test-host-secrets
branch
from
July 16, 2026 13:22
334d65b to
fa4cc7e
Compare
Contributor
Backport failed to create: v3-3-test. View the failure log Run detailsNote: As of Merging PRs targeted for Airflow 3.X In matter of doubt please ask in #release-management Slack channel.
You can attempt to backport this manually by running: cherry_picker a6d87ba v3-3-testThis should apply the commit to the v3-3-test branch and leave the commit in conflict state marking After you have resolved the conflicts, you can continue the backport process by running: cherry_picker --continueIf you don't have cherry-picker installed, see the installation guide. |
1 task
pierrejeambrun
added a commit
that referenced
this pull request
Jul 17, 2026
…#69957) (#70010) The POST /connections/test endpoint restores an existing connection's stored credentials (password/extra) when the request sends the masked sentinel, so a saved connection can be tested without re-typing secrets. Connection configuration users have write-only access to those credentials and are not meant to view them; reusing them while the request points at a caller-supplied host or port applies them against a destination the caller chose rather than the connection's own, which is outside the intent of the retype-free test flow. Scope the credential reuse to requests that keep the stored connection's host and port. Follows the same hardening as #67620. (cherry picked from commit a6d87ba)
vatsrahul1001
pushed a commit
that referenced
this pull request
Aug 5, 2026
…#69957) (#70010) The POST /connections/test endpoint restores an existing connection's stored credentials (password/extra) when the request sends the masked sentinel, so a saved connection can be tested without re-typing secrets. Connection configuration users have write-only access to those credentials and are not meant to view them; reusing them while the request points at a caller-supplied host or port applies them against a destination the caller chose rather than the connection's own, which is outside the intent of the retype-free test flow. Scope the credential reuse to requests that keep the stored connection's host and port. Follows the same hardening as #67620. (cherry picked from commit a6d87ba)
Merged
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When
POST /connections/testreferences an existingconnection_id, it restores that connection's stored credentials (password/extra) so a saved connection can be tested without re-typing secrets.Connection configuration users have write-only access to those credentials and are not meant to view them (Airflow 3 masks them at the API level). Reusing the stored credentials while the request points at a caller-supplied host or port applies them against a destination the caller chose rather than the connection's own — outside the intent of the retype-free test flow.
This scopes the credential reuse to requests that keep the stored connection's host and port; if either is overridden, the test uses exactly what the caller supplied. Follows the same hardening as #67620.
Was generative AI tooling used to co-author this PR?
Generated-by: Claude Code (Opus 4.8) following the guidelines