Skip to content

Fix FAB session cookie TypeError with Werkzeug 3.0+#67141

Open
Sriniketh24 wants to merge 2 commits into
apache:mainfrom
Sriniketh24:fix/fab-session-cookie-bytes-64921
Open

Fix FAB session cookie TypeError with Werkzeug 3.0+#67141
Sriniketh24 wants to merge 2 commits into
apache:mainfrom
Sriniketh24:fix/fab-session-cookie-bytes-64921

Conversation

@Sriniketh24
Copy link
Copy Markdown

@Sriniketh24 Sriniketh24 commented May 18, 2026 •
edited
Loading

Summary

Switch _LazySafeSerializer from msgspec.msgpack to msgspec.json for the database session backend. JSON is human-readable (easier to debug session data in the database) and more widely compatible. The serializer continues to return bytes as required by flask-session's LargeBinary column.

The loads() method tries JSON first and falls back to msgpack, so existing sessions written in msgpack format are read transparently without requiring migration.

related: #64921

Changes

  • providers/fab/src/airflow/providers/fab/www/session.py: Switch _LazySafeSerializer from msgspec.msgpack to msgspec.json encoding. loads() now tries JSON first and falls back to msgpack for legacy session data. Returns bytes for the LargeBinary database column.
  • providers/fab/tests/unit/fab/www/test_session.py: Add 8 tests covering bytes return type, roundtrip, LazyString conversion, legacy msgpack backward compatibility, empty session, nested data, encode/decode aliases, and str/bytes input handling.
Was generative AI tooling used to co-author this PR?
  • Yes — Claude Code (Opus 4.6)

Generated-by: Claude Code (Opus 4.6) following the guidelines

@Sriniketh24
Fix FAB session cookie TypeError with Werkzeug 3.0+
768f04e 
Switch _LazySafeSerializer from msgspec.msgpack (returns bytes) to
msgspec.json (returns str) so that Werkzeug 3.0+ dump_cookie() works
correctly. The loads() method tries JSON first and falls back to
msgpack for backward compatibility with sessions written before this
change.

closes: apache#64921
@Sriniketh24 Sriniketh24 requested a review from vincbeck as a code owner May 18, 2026 23:33
@boring-cyborg
Copy link
Copy Markdown

boring-cyborg Bot commented May 18, 2026

Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide
Here are some useful points:

  • Pay attention to the quality of your code (ruff, mypy and type annotations). Our prek-hooks will help you with that.
  • In case of a new feature add useful documentation (in docstrings or in docs/ directory). Adding a new operator? Check this short guide Consider adding an example Dag that shows how users should use it.
  • Consider using Breeze environment for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
  • Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
  • Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
  • Be sure to read the Airflow Coding style.
  • Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
    Apache Airflow is a community-driven project and together we are making it better 🚀.
    In case of doubts contact the developers at:
    Mailing List: dev@airflow.apache.org
    Slack: https://s.apache.org/airflow-slack

@potiuk
Copy link
Copy Markdown
Member

potiuk commented May 19, 2026

@Sriniketh24 Converting to draft — this PR doesn't yet meet our Pull Request quality criteria.

  • ❌ Provider tests — Failing: Low dep tests: providers / All-prov:LowestDeps:14:3.10:common.compat...fab, provider distributions tests / Compat 3.0.6:P3.10:, provider distributions tests / Compat 3.1.8:P3.10:, provider distributions tests / Compat 3.2.1:P3.10:. See docs.

See the linked criteria for how to fix each item, then mark the PR "Ready for review". This is not a rejection — just an invitation to bring the PR up to standard. No rush.

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. Once you have addressed the points above, an Apache Airflow maintainer — a real person — will take the next look at your PR. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

@potiuk potiuk marked this pull request as draft May 19, 2026 01:26
@Sriniketh24
Fix _LazySafeSerializer to return bytes for database BLOB column
a3d8050 
dumps() must return bytes because flask-session stores the serialized
data in a LargeBinary (BLOB) column. The previous commit incorrectly
returned str which caused a TypeError on INSERT.

Keep the JSON encoding format (instead of the original msgpack) for
readability and forward compatibility, with backward-compatible
loads() that falls back to msgpack for legacy sessions.
@Sriniketh24 Sriniketh24 marked this pull request as ready for review May 22, 2026 05:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vincbeck vincbeck Awaiting requested review from vincbeck vincbeck is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

area:providers provider:fab

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Sriniketh24 @potiuk