[3.0.0] Removal of AIRFLOW__WEBSERVER__ENABLE_PROXY_FIX is breaking FAB OAuth sign in

[Guymestef]

Apache Airflow version

3.0.0

If "Other Airflow 2 version" selected, which one?

No response

What happened?

FAB is poorly managing redirect_uri creation while initiating authentication to an oauth provider.
redirect_uri is using http instead of https, so authentication is failing due to a mismatch redirect_uri

To "fix" this issue, a workaround was provided in the 2.x version, by setting the config AIRFLOW__WEBSERVER__ENABLE_PROXY_FIX = True

By removing the proxy fix, oauth sign in with FAB is broken

What you think should happen instead?

Keep the proxy fix until

How to reproduce

• Using airflow with https
• setting AIRFLOW__CORE__AUTH_MANAGER = airflow.providers.fab.auth_manager.fab_auth_manager.FabAuthManager
• configuring github oauth provider

Operating System

ubuntu

Versions of Apache Airflow Providers

No response

Deployment

Other 3rd-party Helm chart

Deployment details

No response

Anything else?

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[boring-cyborg]

Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.

[zachliu]

i'm in the same boat, i had to temporarily change the redirect_uri from https to http in my oauth provider

[gschuurman]

This is a simmilar issue as #49705

It seems that the original code for the proxy fix was removed:

airflow/airflow/www/extensions/init_wsgi_middlewares.py

Lines 53 to 61 in b93c3db

	if conf.getboolean("webserver", "ENABLE_PROXY_FIX"):
	flask_app.wsgi_app = ProxyFix( # type: ignore
	flask_app.wsgi_app,
	x_for=conf.getint("webserver", "PROXY_FIX_X_FOR", fallback=1),
	x_proto=conf.getint("webserver", "PROXY_FIX_X_PROTO", fallback=1),
	x_host=conf.getint("webserver", "PROXY_FIX_X_HOST", fallback=1),
	x_port=conf.getint("webserver", "PROXY_FIX_X_PORT", fallback=1),
	x_prefix=conf.getint("webserver", "PROXY_FIX_X_PREFIX", fallback=1),
	)

The middleware itself should be compatible be working since werkzeug is still used.

Embedding a custom plugin should allow a fix: https://airflow.apache.org/docs/apache-airflow/stable/administration-and-deployment/plugins.html#example

[gschuurman]

I managed to get it working, in your webserver_config.py you need to add some code:

from flask import current_app
from werkzeug.middleware.proxy_fix import ProxyFix

if conf.getboolean("webserver", "ENABLE_PROXY_FIX"):
    current_app.wsgi_app = ProxyFix(  # type: ignore
        current_app.wsgi_app,
        x_for=conf.getint("webserver", "PROXY_FIX_X_FOR", fallback=1),
        x_proto=conf.getint("webserver", "PROXY_FIX_X_PROTO", fallback=1),
        x_host=conf.getint("webserver", "PROXY_FIX_X_HOST", fallback=1),
        x_port=conf.getint("webserver", "PROXY_FIX_X_PORT", fallback=1),
        x_prefix=conf.getint("webserver", "PROXY_FIX_X_PREFIX", fallback=1),

By doing this the proxy_headers will be set correctly for all calls to flask_app_builder.