From 1b3b825b470c687b5bcdd93587a730f9e447ffff Mon Sep 17 00:00:00 2001 From: Bugra Ozturk Date: Mon, 15 Dec 2025 22:03:35 +0100 Subject: [PATCH] [v3-1-test] Add Refresh Token logic to auth manager docs (#54196) * Update httponly logic in docs (cherry picked from commit 1ba1732caf0910bf32acc32db1e32e82e26144a6) Co-authored-by: Bugra Ozturk --- .../docs/core-concepts/auth-manager/index.rst | 22 +++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/airflow-core/docs/core-concepts/auth-manager/index.rst b/airflow-core/docs/core-concepts/auth-manager/index.rst index 5ace2150eb87d..258b9aae3622a 100644 --- a/airflow-core/docs/core-concepts/auth-manager/index.rst +++ b/airflow-core/docs/core-concepts/auth-manager/index.rst @@ -170,8 +170,26 @@ cookie named ``_token`` before redirecting to the Airflow UI. The Airflow UI wil return response .. note:: - Do not set the cookie parameter ``httponly`` to ``True``. Airflow UI needs to access the JWT token from the cookie. - + Ensure that the cookie parameter ``httponly`` is set to ``True``. The UI does not manage the token. + +Refreshing JWT Token +'''''''''''''''''''' +Refreshing token is optional feature and its availability depends on the specific implementation of the auth manager. +The auth manager is responsible for refreshing the JWT token when it expires. +The Airflow API uses middleware that intercepts every request and checks the validity of the JWT token. +Token communication is handled through ``httponly`` cookies to improve security. +When the token expires, the `JWTRefreshMiddleware `_ middleware calls the auth manager's ``refresh_user`` method to obtain a new token. + + +To support token refresh operations, the auth manager must implement the ``refresh_user`` method. +This method receives an expired token and must return a new valid token. +User information is extracted from the expired token and used to generate a fresh token. + +An example implementation of ``refresh_user`` could be: +`KeycloakAuthManager::refresh_user `_ +User information is derived from the ``BaseUser`` instance. +It is important that the user object contains all the fields required to refresh the token. An example user class could be: +`KeycloakAuthManagerUser(BaseUser) `_. Optional methods recommended to override for optimization ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^