Skip to content

Commit

Permalink
[AIRFLOW-2884] Fix Flask SECRET_KEY security issue in www_rbac
Browse files Browse the repository at this point in the history
The same issue was fixed for /www previously in
PR #3651
(JIRA ticket 2809)
  • Loading branch information
XD-DENG committed Aug 10, 2018
1 parent c7551f6 commit 97b2735
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 1 deletion.
2 changes: 2 additions & 0 deletions airflow/config_templates/default_airflow.cfg
Original file line number Diff line number Diff line change
Expand Up @@ -250,6 +250,8 @@ worker_refresh_batch_size = 1
worker_refresh_interval = 30

# Secret key used to run your flask app
# If default value is given ("temporary_key"), a random secret_key will be generated
# when you launch your webserver for security reason
secret_key = temporary_key

# Number of workers to run the Gunicorn web server
Expand Down
6 changes: 5 additions & 1 deletion airflow/www_rbac/app.py
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
#
import socket
import six
import os

from flask import Flask
from flask_appbuilder import AppBuilder, SQLA
Expand All @@ -42,7 +43,10 @@ def create_app(config=None, session=None, testing=False, app_name="Airflow"):
global app, appbuilder
app = Flask(__name__)
app.wsgi_app = ProxyFix(app.wsgi_app)
app.secret_key = conf.get('webserver', 'SECRET_KEY')
if conf.get('webserver', 'SECRET_KEY') == "temporary_key":
app.secret_key = os.urandom(16)
else:
app.secret_key = conf.get('webserver', 'SECRET_KEY')

airflow_home_path = conf.get('core', 'AIRFLOW_HOME')
webserver_config_path = airflow_home_path + '/webserver_config.py'
Expand Down

0 comments on commit 97b2735

Please sign in to comment.