Taks 1 - Refactor get_api_endpoints()

[Satoshi-Sh]

Problem Definiton

Ref: Github Pull Request #36052 VladaZakharova commented on Jan 18

In the init_api_auth_provider method, we update the base path as follows:

def init_api_auth_provider(connexion_app: connexion.FlaskApp):
    """Initialize the API offered by the auth manager."""
    auth_mgr = get_auth_manager()
    blueprint = auth_mgr.get_api_endpoints(connexion_app)
    if blueprint:
        base_paths.append(blueprint.url_prefix if blueprint.url_prefix else "")
        flask_app = connexion_app.app
        flask_app.extensions["csrf"].exempt(blueprint)

However, the blueprint object obtained from auth_mgr.get_api_endpoints(connexion_app) will always be None if we are using ConnexionV3.

Proposed solution

Ref vincbeck commented on Jan 18

• Rename get_api_endpoints to set_api_endpoints. The return type should be updated to None. Documentation should be updated as well to something like "Set API endpoint(s) definition for the auth manager.". This is a breaking change but nobody uses this interface yet, so it is a good time to do it.
• This piece of code flask_app.extensions["csrf"].exempt(blueprint) should be moved in the set_api_endpoints method using appbuilder.app.extensions["csrf"].exempt(api.blueprint)

How to test

• Run client tests python ./clients/python/test_python_client.py

[sudiptob2]

We do not have any blueprint here, so we can not update base_path But we need to handle base path update logic somewhere. Whats the impact of removing this line.

[sudiptob2]

Suggested change

	return None
	self.appbuilder.app.extensions["csrf"].exempt(api.blueprint)
	return None

According to the proposed solution, you it is suggested to move it here I guess.

[Satoshi-Sh]

This doesn't give you KeyError "crsf"?

[sudiptob2]

yeah, you have to add an if statement. But this does not solve the CSRF error

[sudiptob2]

        if api:
            self.appbuilder.app.extensions["csrf"].exempt(api.blueprint)
        return None

[Satoshi-Sh]

Looks like this connexion_app.add_api() doesn't return an object, so I just removed "if" statement.

I kind of understanding Vlada's struggle now.

[sudiptob2]

Yes, I think that is why, CSRF error is still there. In this comment I think Rob suggested some solution
apache#36052 (comment)

[Satoshi-Sh]

I'm not sure what he meant here. I might need some time to understand it.

"Find a way to add csrf extension to a newly created blueprint using connexion: to retrieve blueprint object from connexion_app variable to save the current logic (flask_app.extensions["csrf"].exempt(blueprint)) or find a way to add this extension on connexion level(check the documentation for available options)."

Seems like we cannot get the blueprint, so we better focus on the second option(add this extension on the connexion level). I'm reading the connexion source code, but no luck yet.

[Satoshi-Sh]

Probably need to understand this repo. I will let you know if I find something useful.

[Satoshi-Sh]

Problem

Due to the upgrading connextion v3, we cannot access blueprints( they moved the blueprint registration code inside their codebase). We used the returned blueprint to make exemptions to accept HTTP(S) requests without "csrf token" in the header. When the client makes a post request, it doesn't include a csrf token. That's why we get csrf token missing error with test_python_client.py

@RobbeSneyders suggested utilizing the middleware library asgi-csrf to do the same without using blueprints.

def skip_api_paths(scope)
    return scope["path"].startswith("/api/")

app = asgi_csrf(
    app,
    signing_secret="secret-goes-here",
    skip_if_scope=skip_api_paths
)

This is a sample code to make csrf-token exemption.

• What the score will be in the airflow project?
• I'm not sure about siginig_secret. Do I need to generate it or can get it from somewhere?

I'm trying to implement this on "/api/v1/" and random signing_secret for now.

[Satoshi-Sh]

I just tried to use asgi_csrf but it doesn't work as expected. I might've made some mistakes in the implementation. I just pushed it so that you can have a look at it. @sudiptob2