fix: always include kid in JWT header for symmetric key tokens#62883
Merged
eladkal merged 1 commit intoapache:mainfrom Mar 5, 2026
Merged
fix: always include kid in JWT header for symmetric key tokens#62883eladkal merged 1 commit intoapache:mainfrom
eladkal merged 1 commit intoapache:mainfrom
Conversation
vincbeck
approved these changes
Mar 4, 2026
2221148 to
f33e524
Compare
2 tasks
2d04b7b to
a77f451
Compare
When using symmetric (secret_key) signing, the JWTGenerator did not include the 'kid' field in the JWT header. However, JWTValidator always requires 'kid' in the token header, causing all symmetric-key tokens to be rejected with 'Missing kid in token header'. This affected the KeycloakAuthManager (and any auth manager using symmetric JWT signing), creating an infinite redirect loop after successful login. Two changes: 1. Always add 'kid' to the JWT header regardless of key type 2. Check configured jwt_kid before falling back to 'not-used' for symmetric keys, so operators can set a meaningful kid Closes: apache#62876
a77f451 to
fdf6655
Compare
github-actions Bot
pushed a commit
that referenced
this pull request
Mar 5, 2026
…okens (#62883) When using symmetric (secret_key) signing, the JWTGenerator did not include the 'kid' field in the JWT header. However, JWTValidator always requires 'kid' in the token header, causing all symmetric-key tokens to be rejected with 'Missing kid in token header'. This affected the KeycloakAuthManager (and any auth manager using symmetric JWT signing), creating an infinite redirect loop after successful login. Two changes: 1. Always add 'kid' to the JWT header regardless of key type 2. Check configured jwt_kid before falling back to 'not-used' for symmetric keys, so operators can set a meaningful kid (cherry picked from commit 6b21ec0) Co-authored-by: Yoann <60654707+YoannAbriel@users.noreply.github.com> Closes: #62876
Contributor
Backport successfully created: v3-1-testNote: As of Merging PRs targeted for Airflow 3.X In matter of doubt please ask in #release-management Slack channel.
|
eladkal
pushed a commit
that referenced
this pull request
Mar 5, 2026
…okens (#62883) (#62943) When using symmetric (secret_key) signing, the JWTGenerator did not include the 'kid' field in the JWT header. However, JWTValidator always requires 'kid' in the token header, causing all symmetric-key tokens to be rejected with 'Missing kid in token header'. This affected the KeycloakAuthManager (and any auth manager using symmetric JWT signing), creating an infinite redirect loop after successful login. Two changes: 1. Always add 'kid' to the JWT header regardless of key type 2. Check configured jwt_kid before falling back to 'not-used' for symmetric keys, so operators can set a meaningful kid (cherry picked from commit 6b21ec0) Closes: #62876 Co-authored-by: Yoann <60654707+YoannAbriel@users.noreply.github.com>
dominikhei
pushed a commit
to dominikhei/airflow
that referenced
this pull request
Mar 11, 2026
…e#62883) When using symmetric (secret_key) signing, the JWTGenerator did not include the 'kid' field in the JWT header. However, JWTValidator always requires 'kid' in the token header, causing all symmetric-key tokens to be rejected with 'Missing kid in token header'. This affected the KeycloakAuthManager (and any auth manager using symmetric JWT signing), creating an infinite redirect loop after successful login. Two changes: 1. Always add 'kid' to the JWT header regardless of key type 2. Check configured jwt_kid before falling back to 'not-used' for symmetric keys, so operators can set a meaningful kid Closes: apache#62876
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When using
KeycloakAuthManager(or any auth manager) with symmetric JWT signing (HS256 + secret key), the authentication flow enters an infinite redirect loop. After successful login, the internal session JWT is rejected by the FastAPIJWTValidatorwith:Missing 'kid' in token header.Root Cause
JWTGenerator.generate()only added thekidfield to the JWT header when using asymmetric (private key) signing. Symmetric (secret key) tokens never gotkidin the header. However,JWTValidator._get_kid_from_header()unconditionally requireskidin the token header, causing all symmetric-key tokens to fail validation.Additionally,
_generate_kid()returned"not-used"immediately for symmetric keys without checking theapi_auth.jwt_kidconfiguration, so operators couldn't set a meaningfulkidfor their symmetric setup.Fix
Two changes in
airflow-core/src/airflow/api_fastapi/auth/tokens.py:kidin the JWT header — removed theif self._private_key:guard soheaders["kid"] = self.kidruns for both symmetric and asymmetric keys.jwt_kidbefore falling back — reordered_generate_kid()to check theapi_auth.jwt_kidconfig option first, before returning the"not-used"fallback for symmetric keys. This lets operators configure a customkidregardless of key type.Added two unit tests: one verifying symmetric tokens include
kidin the header, another verifying the configuredjwt_kidis respected for symmetric keys.Closes: #62876
Was generative AI tooling used to co-author this PR?
Generated-by: Claude Code following the guidelines
{pr_number}.significant.rstor{issue_number}.significant.rst, in airflow-core/newsfragments.