Allowed hosts for rest api request

[fedeizzo]

Description

I would like to see a config in the api section in order to add allowed hosts for making http request and solve cross origin problem. Now, if a make an async request from browser a cross origin error occurs.

Use case / motivation

If I'm writing a dashboard for a end-user who want to see the current dag status I could create a dag with some graphical js library. The dag is created fetching webserver api in background. A possible implementation could be:

[api]
enable_experimental_api = False
auth_backend = airflow.api.auth.backend.basic_auth
allowed_hosts = ['myDomain1.com', 'myDomain2.org']

Are you willing to submit a PR?

No

Related Issues

No

[boring-cyborg]

Thanks for opening your first issue here! Be sure to follow the issue template!

[uranusjr]

How are you deploying Airflow? As far as I know, Airflow does not implement any logic to block host header attacks (I could be wrong), so there’s nothing to configure in Airflow. This needs to be configured in your proxy server instead.

[fedeizzo]

Currently, in a dev environment, from azure portal I opened the airflow webserver port. I'm running scheduler and webserver as background processes.
Now I'm working on a react webapp in which I want to display some informations about dag runs.
Is the idea correct or I'm doing something in the wrong way?

[uranusjr]

I'm running scheduler and webserver as background processes

So you’re basically running airflow webserver? I believe that exposes the host as 0.0.0.0:8080 and should just work.

[fedeizzo]

Yes, the webserver is exposed and the dashboard is available through http. But if I try to fetch the rest API from my local development environment (my pc running node with react) I receive the cross origin error. Obviously the domain is not the same: the airflow webserver on azure machine and react from my machine. The same situation could happen if I move my react app in another vps different from the one in which airflow is running

[uranusjr]

Ah OK, so the problem is with indeed with CORS. The feature was added only recently and unreleased, so I was confusing your issue with Location header protection (which we don’t have a knob for).

The implementation was added in #13620 and (I believe) will be in the next Airflow release.

[fedeizzo]

Ok. Thanks for your help

[mik-laj]

We added CORS support, so we can close this ticket