"Blocked script execution" in security/users page

[dnallicus]

Apache Airflow version

3.0.0

If "Other Airflow 2 version" selected, which one?

No response

What happened?

When you use the Flask Appbuilder for security, the security/users page doesn't have 'allow-scripts', so none of the buttons work:

airflow/airflow-core/src/airflow/ui/src/pages/Security.tsx

Line 49 in d66a1e5

sandbox="allow-same-origin allow-forms"

,

What you think should happen instead?

This is the error, it shouldn't block:
Blocked script execution in '' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.

How to reproduce

use FabAuthManager as the auth manage with AUTH_REMOTE_USER

Operating System

airflow:3.0.0 docker image

Versions of Apache Airflow Providers

No response

Deployment

Docker-Compose

Deployment details

No response

Anything else?

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[boring-cyborg]

Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.

[amoghrajesh]

CC @vincbeck / @pierrejeambrun.

Maybe we should add the 'allow-scripts', but it should be only for trusted domains

[kevinhongzl]

Hi @amoghrajesh @pierrejeambrun. I'd like to help with this issue

[pierrejeambrun]

@kevinhongzl Thanks for showing interest in this. I just assigned you :)