[AIRFLOW-6352] security - ui - add login timeout (apache#6912)

airflow/config_templates/default_airflow.cfg

@@ -370,10 +370,13 @@ default_wrap = False
 # on webserver startup
 update_fab_perms = True
 
+# Minutes of non-activity before logged out from UI
+# 0 means never get forcibly logged out
+force_log_out_after = 0
+
 [email]
 email_backend = airflow.utils.email.send_email_smtp
 
-
 [smtp]
 # If you want airflow to send emails on retries, failure, and you want to use
 # the airflow.utils.email.send_email_smtp function, you have to configure an

airflow/www/app.py

@@ -17,11 +17,14 @@
 # specific language governing permissions and limitations
 # under the License.
 #
+import datetime
 import logging
 import socket
 from typing import Any, Optional
 from urllib.parse import urlparse
 
+import flask
+import flask_login
 from flask import Flask
 from flask_appbuilder import SQLA, AppBuilder
 from flask_caching import Cache
@@ -229,6 +232,15 @@ def jinja_globals():  # pylint: disable=unused-variable
 
             return globals
 
+        @app.before_request
+        def before_request():
+            _force_log_out_after = conf.getint('webserver', 'FORCE_LOG_OUT_AFTER', fallback=0)
+            if _force_log_out_after > 0:
+                flask.session.permanent = True
+                app.permanent_session_lifetime = datetime.timedelta(minutes=_force_log_out_after)
+                flask.session.modified = True
+                flask.g.user = flask_login.current_user
+
         @app.teardown_appcontext
         def shutdown_session(exception=None):  # pylint: disable=unused-variable
             settings.Session.remove()