CSRF token to expire with session when config file exists #36869

Apache Airflow version

2.8.0

If "Other Airflow 2 version" selected, which one?

No response

What happened?

Despite #28730, I encounter the message that the CSRF token has expired, although I checked that the session has not ended:

The reason why this still happens is because I have defined a custom webserver config, where the argument WTF_CSRF_TIME_LIMIT is not specified at all.

What you think should happen instead?

As is discussed in #28730, it is completely unnecessary for the CSRF token to expire before the end of a session, as it does not provide any extra security.

The default value of WTF_CSRF_TIME_LIMIT should be the same regardless of if there is a webserver config file or not, unless explicitly overridden.

How to reproduce

Define a custom webserver config where the argument WTF_CSRF_TIME_LIMIT is not specified at all. Then just wait until the CSRF token expires.

And as is seen clearly in this function,
https://github.com/apache/airflow/blob/681859c7bffabce0c294060d811db2fb16851816/airflow/configuration.py#L2059C1-L2066C96,
if you have specified a custom webserver config, the values in the default webserver config are ignored. Thus the CSRF expiry time will take on the flask default, i.e. 3600 seconds, instead of the airflow default which is None.

Operating System

MacOS

Versions of Apache Airflow Providers

No response

Deployment

Amazon (AWS) MWAA

Deployment details

No response

Anything else?

It is of course possible to specify the argument WTF_CSRF_TIME_LIMIT = None in the custom webserver config. However, this CSRF expiry issue can be a real headache and it took quite some time to figure out the fix, so it would be nice to solve this once and for all.

One could also argue that if one creates a custom webserver config, one should copy the default values first. In my case, however, this was done before #28730, so even if we now use a new airflow version, we still used the same config. I suspect this is the case for many others as well.

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct