Change expose_hostname default to false

airflow/config_templates/config.yml

@@ -1340,7 +1340,7 @@ webserver:
       version_added: 1.10.8
       type: string
       example: ~
-      default: "True"
+      default: "False"
     expose_stacktrace:
       description: |
         Expose stacktrace in the web server

airflow/config_templates/default_airflow.cfg

@@ -701,7 +701,7 @@ access_logformat =
 expose_config = False
 
 # Expose hostname in the web server
-expose_hostname = True
+expose_hostname = False
 
 # Expose stacktrace in the web server
 expose_stacktrace = False

airflow/www/auth.py

@@ -50,7 +50,7 @@ def decorated(*args, **kwargs):
                     render_template(
                         "airflow/no_roles_permissions.html",
                         hostname=get_hostname()
-                        if conf.getboolean("webserver", "EXPOSE_HOSTNAME", fallback=True)
+                        if conf.getboolean("webserver", "EXPOSE_HOSTNAME")
                         else "redact",
                         logout_url=appbuilder.get_url_for_logout,
                     ),

airflow/www/extensions/init_jinja_globals.py

@@ -43,7 +43,7 @@ def init_jinja_globals(app):
     if not default_ui_timezone:
         default_ui_timezone = server_timezone
 
-    expose_hostname = conf.getboolean("webserver", "EXPOSE_HOSTNAME", fallback=True)
+    expose_hostname = conf.getboolean("webserver", "EXPOSE_HOSTNAME")
     hostname = get_hostname() if expose_hostname else "redact"
 
     try:

airflow/www/views.py

@@ -566,9 +566,7 @@ def not_found(error):
     return (
         render_template(
             "airflow/error.html",
-            hostname=get_hostname()
-            if conf.getboolean("webserver", "EXPOSE_HOSTNAME", fallback=True)
-            else "redact",
+            hostname=get_hostname() if conf.getboolean("webserver", "EXPOSE_HOSTNAME") else "redact",
             status_code=404,
             error_message="Page cannot be found.",
         ),
@@ -581,9 +579,7 @@ def method_not_allowed(error):
     return (
         render_template(
             "airflow/error.html",
-            hostname=get_hostname()
-            if conf.getboolean("webserver", "EXPOSE_HOSTNAME", fallback=True)
-            else "redact",
+            hostname=get_hostname() if conf.getboolean("webserver", "EXPOSE_HOSTNAME") else "redact",
             status_code=405,
             error_message="Received an invalid request.",
         ),
@@ -599,10 +595,10 @@ def show_traceback(error):
             python_version=sys.version.split(" ")[0] if g.user.is_authenticated else "redact",
             airflow_version=version if g.user.is_authenticated else "redact",
             hostname=get_hostname()
-            if conf.getboolean("webserver", "EXPOSE_HOSTNAME", fallback=True) and g.user.is_authenticated
+            if conf.getboolean("webserver", "EXPOSE_HOSTNAME") and g.user.is_authenticated
             else "redact",
             info=traceback.format_exc()
-            if conf.getboolean("webserver", "EXPOSE_STACKTRACE", fallback=True) and g.user.is_authenticated
+            if conf.getboolean("webserver", "EXPOSE_STACKTRACE") and g.user.is_authenticated
             else "Error! Please contact server admin.",
         ),
         500,

newsfragments/29547.significant.rst

@@ -0,0 +1,3 @@
+Default for ``[webserver] expose_hostname`` changed to ``False``
+
+The default for ``[webserver] expose_hostname`` has been set to ``False``, instead of ``True``. This means administrators must opt-in to expose webserver hostnames to end users.