Add ability to configure PERMANENT_SESSION_LIFETIME in fab for session logout.

[tirkarthi]

When a user logs in through FAB the session cookie is set and once the jwt token for the UI expires the UI redirects to the login page. The login page picks up the session cookie to login back the user and redirect them to home page. The value for PERMANENT_SESSION_LIFETIME in flask is 31 days by default. This causes a logged in user to be active for 31 days despite the jwt token expiration time. This used to be configurable in Airflow 2 in old webserver code using Flask and this PR adds back the option to configure it through webserver.session_lifetime_minutes in airflow configuration with default value of 43200 minutes ( 30 days).

Another consideration is do we need this setting at all since Airflow 2 used FAB and session but Airflow 3 uses JWT token so JWT token expiry should effectively logout the user and user should not be auto logged in which means this should be set to zero.

https://flask.palletsprojects.com/en/stable/config/#PERMANENT_SESSION_LIFETIME

Related #48787

[pierrejeambrun]

Nice,

Maybe the setting should be renamed to fab_session_lifetime_minutes in the config ? And the config doc should be updated to explain that this is only relative to the FAB auth manager because this is the only one that still uses sessions for now.

(And I think we wanted to find a way to remove that, so no session are ever used in AF3 UI but not sure if this is realistic)

[vincbeck]

Nice,

Maybe the setting should be renamed to fab_session_lifetime_minutes in the config ? And the config doc should be updated to explain that this is only relative to the FAB auth manager because this is the only one that still uses sessions for now.

(And I think we wanted to find a way to remove that, so no session are ever used in AF3 UI but not sure if this is realistic)

I do not think we have control over this name. This is a constant in Fab

[tirkarthi]

(And I think we wanted to find a way to remove that, so no session are ever used in AF3 UI but not sure if this is realistic)

One way to achieve this would be setting it to 0 which should just make the session expire as set.

Regarding renaming it as fab_session_lifetime_minutes in airflow.cfg I assume it's sort of late in the release candidate phase to do a rename and I might not have the bandwidth to do it, sorry. Maybe Airflow 3.1+ .

[pierrejeambrun]

I do not think we have control over this name. This is a constant in Fab

settings.get_session_lifetime_config() is reading from conf.get("webserver", "session_lifetime_minutes", fallback=None) I think we should update that conf parameter to "webserver", "fab_session_lifetime_minutes" so it's clear it only affects the fab auth manager, and add that to the description to.

[vincbeck]

get_session_lifetime_config

get_session_lifetime_config is not used, am I wrong? I think we should delete it

[tirkarthi]

get_session_lifetime_config

get_session_lifetime_config is not used, am I wrong? I think we should delete it

It's used in this PR now. This is the function that calculates the fab session cookie timeout value configured through airflow.cfg

[vincbeck]

Oh! I got it now :) So I agree with Pierre, we should:

• Move this function to FAB provider
• Rename the config [webserver] session_lifetime_minutes to [fab] session_lifetime_minutes. It should not be an Airflow core config but a fab provider config

[tirkarthi]

Thanks @pierrejeambrun and @vincbeck . I made the following changes.

1. Moved configuration and function from webserver to fab.
2. Updated the changelog and tests.

[tirkarthi]

To disable this feature of auto renewal between 31 days and to have jwt_expiration_time as the expiration users can set this to a short time like 1 to 2 seconds so that the cookie always expires.

[tirkarthi]

https://github.com/apache/airflow/security/code-scanning/460 . The config value logged is flagged as a security issue which I marked as resolved since it's not sensitive.

[vincbeck]

Please also add a significant newsfragment

[vincbeck]

Would you be able to update it today? Sorry the timing is quite tight :) We should merge this one before the next RC

[tirkarthi]

Please` also add a significant newsfragment

There is already a significant fragment for this with no release made yet. I just updated it to moving to fab section. Is there something else I am missing?

File : airflow-core/newsfragments/41550.significant.rst

[vincbeck]

Please` also add a significant newsfragment

There is already a significant fragment for this with no release made yet. I just updated it to moving to fab section. Is there something else I am missing?

File : airflow-core/newsfragments/41550.significant.rst

That's fair :)

[vincbeck]

LGTM! Thank you for the updates

[tirkarthi]

Thanks @vincbeck and @pierrejeambrun .