Skip to content

AIP-84 : Add JWT token revokation for logout invalidation (#47952)#61339

Merged
vincbeck merged 19 commits intoapache:mainfrom
anishgirianish:feature/47952-aip-token-invalidation-on-logout
Feb 5, 2026
Merged

AIP-84 : Add JWT token revokation for logout invalidation (#47952)#61339
vincbeck merged 19 commits intoapache:mainfrom
anishgirianish:feature/47952-aip-token-invalidation-on-logout

Conversation

@anishgirianish
Copy link
Copy Markdown
Contributor

@anishgirianish anishgirianish commented Feb 1, 2026 •
edited
Loading

Summary

  • Adds a revoked_token table to persist revoked JWT token JTIs on logout
  • On logout, the token's jti is extracted and stored with its exp timestamp
  • On every authenticated request, get_user_from_token checks if the jti has been revoked before allowing access
  • Expired revoked tokens are automatically cleaned up via the existingdb_cleanup mechanism

closes: #47952

@boring-cyborg boring-cyborg bot added area:API Airflow's REST/HTTP API area:db-migrations PRs with DB migration kind:documentation labels Feb 1, 2026
@anishgirianish anishgirianish marked this pull request as draft February 2, 2026 01:17
@anishgirianish anishgirianish marked this pull request as ready for review February 2, 2026 04:45
@anishgirianish anishgirianish mentioned this pull request Feb 2, 2026
Closed
1 task
jason810496
jason810496 reviewed Feb 2, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@jason810496 jason810496 left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice! Thanks for the PR and it LGTM.
I think this PR is on the correct direction to resolve #47952.

@anishgirianish anishgirianish force-pushed the feature/47952-aip-token-invalidation-on-logout branch 2 times, most recently from 0c84287 to e7f823e Compare February 2, 2026 21:39
vincbeck
vincbeck reviewed Feb 2, 2026
View reviewed changes
jason810496
jason810496 reviewed Feb 3, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@jason810496 jason810496 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These added tests were already part of the existing TestLogout class.,

My bad, I overstated the the TestLogout class above.

Nice! Regarding the public method Vincent mentioned, the tests look good, and rest of the changes LGTM. Thanks!

@anishgirianish anishgirianish force-pushed the feature/47952-aip-token-invalidation-on-logout branch from e7f823e to 3be8480 Compare February 3, 2026 04:58
@potiuk
Copy link
Copy Markdown
Member

potiuk commented Feb 3, 2026

Nice. Tests need to be fixed of course, and I think we should also add another thing - auto cleanup not only on clean_db but run (not always - just from time to time - we could store in memory last time when it was run and run it after an hour passes or so - when a token is checked.

That will slightly slow down some login attempts - but it will also auto-clean the db when airflow db cleanup is not run periodically. simply those expired tokens are not useful immediately after they expired.

vincbeck
vincbeck approved these changes Feb 3, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@vincbeck vincbeck left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Very good!

@anishgirianish anishgirianish force-pushed the feature/47952-aip-token-invalidation-on-logout branch 2 times, most recently from 3b52ca2 to 0c51fff Compare February 4, 2026 06:19
jason810496
jason810496 reviewed Feb 4, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@jason810496 jason810496 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice! Thanks for addressing the comments and fixing the tests.

@anishgirianish anishgirianish force-pushed the feature/47952-aip-token-invalidation-on-logout branch from 397534c to 5e0c33b Compare February 4, 2026 15:55
bugraoz93
bugraoz93 approved these changes Feb 4, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@bugraoz93 bugraoz93 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, thanks @anishgirianish!

@bugraoz93
Copy link
Copy Markdown
Contributor

bugraoz93 commented Feb 4, 2026

I would like to call this PR for the protm if no one disagrees :)

#protm, which is solving a good problem for the token lifecycle. Additionally, it opens the door for great security improvement(s), such as a token invalidation endpoint for administrators in case of a token leak.

@vincbeck
Copy link
Copy Markdown
Contributor

vincbeck commented Feb 4, 2026

I would like to call this PR for the protm if no one disagrees :)

#protm, which is solving a good problem for the token lifecycle. Additionally, it opens the door for great security improvement(s), such as a token invalidation endpoint for administrators in case of a token leak.

Agree!

jason810496
jason810496 approved these changes Feb 5, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@jason810496 jason810496 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would like to call this PR for the protm if no one disagrees :)

+1 for that!

@vincbeck vincbeck merged commit b3306f1 into apache:main Feb 5, 2026
129 checks passed
pierrejeambrun
pierrejeambrun reviewed Feb 5, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@pierrejeambrun pierrejeambrun left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great one!

jhgoebbert pushed a commit to jhgoebbert/airflow_Owen-CH-Leung that referenced this pull request Feb 8, 2026
@anishgirianish @jhgoebbert
AIP-84 : Add JWT token revokation for logout invalidation (apache#47952…
a5709b0 
…) (apache#61339)
Ratasa143 pushed a commit to Ratasa143/airflow that referenced this pull request Feb 15, 2026
@anishgirianish @Ratasa143
AIP-84 : Add JWT token revokation for logout invalidation (apache#47952…
30cd3ca 
…) (apache#61339)
choo121600 pushed a commit to choo121600/airflow that referenced this pull request Feb 22, 2026
@anishgirianish @choo121600
AIP-84 : Add JWT token revokation for logout invalidation (apache#47952…
9e5a565 
…) (apache#61339)
Subham-KRLX pushed a commit to Subham-KRLX/airflow that referenced this pull request Mar 4, 2026
@anishgirianish @Subham-KRLX
AIP-84 : Add JWT token revokation for logout invalidation (apache#47952…
4fcd994 
…) (apache#61339)
dominikhei pushed a commit to dominikhei/airflow that referenced this pull request Mar 11, 2026
@anishgirianish @dominikhei
AIP-84 : Add JWT token revokation for logout invalidation (apache#47952…
92871c2 
…) (apache#61339)
Ankurdeewan pushed a commit to Ankurdeewan/airflow that referenced this pull request Mar 15, 2026
@anishgirianish @Ankurdeewan
AIP-84 : Add JWT token revokation for logout invalidation (apache#47952…
a8ed57a 
…) (apache#61339)
radhwene pushed a commit to radhwene/airflow that referenced this pull request Mar 21, 2026
@anishgirianish
AIP-84 : Add JWT token revokation for logout invalidation (apache#47952…
07e14f6 
…) (apache#61339)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pierrejeambrun pierrejeambrun pierrejeambrun left review comments

@bugraoz93 bugraoz93 bugraoz93 approved these changes

@jason810496 jason810496 jason810496 approved these changes

@vincbeck vincbeck vincbeck approved these changes

@ephraimbuddy ephraimbuddy Awaiting requested review from ephraimbuddy ephraimbuddy is a code owner

@rawwar rawwar Awaiting requested review from rawwar rawwar is a code owner

@shubhamraj-git shubhamraj-git Awaiting requested review from shubhamraj-git shubhamraj-git is a code owner

@choo121600 choo121600 Awaiting requested review from choo121600 choo121600 is a code owner

@XD-DENG XD-DENG Awaiting requested review from XD-DENG XD-DENG is a code owner

@ashb ashb Awaiting requested review from ashb ashb is a code owner

Assignees

No one assigned

Labels

area:API Airflow's REST/HTTP API area:db-migrations PRs with DB migration kind:documentation

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

AIP-84 Token Invalidation

6 participants

@anishgirianish @potiuk @bugraoz93 @vincbeck @pierrejeambrun @jason810496