airflow-rest-api-plugin icon indicating copy to clipboard operation
airflow-rest-api-plugin copied to clipboard

Published 20 hours ago • verified publisher icon teamclairvoyant

Disabling CSRF is a security risk - and not needed

Open ashb opened this issue 4 years ago • 4 comments

The RBAC UI for Airflow uses a different instance of the CSRF protection, so we need to import both decorators to be CSRF exempt when under RBAC UI.

Closes #73 and likely fixes #72 too

ashb avatar Jul 15 '20 10:07 ashb

cc @prakshalj0512 @rssanders3

kaxil avatar Oct 06 '20 17:10 kaxil

@kaxil Are these changes compatible with Airflow 1.8 and 1.9 as well?

prakshalj0512 avatar Oct 06 '20 17:10 prakshalj0512

Yes, the except ImportError block should take care of it

ashb avatar Oct 07 '20 10:10 ashb

@prakshalj0512 Ping. Please can you either fix this security issue and release a new version, or mark this repo as abandoned and place a prominent notice at the top of the readme?

ashb avatar Apr 19 '21 09:04 ashb