Fix JWT token generation with unset issuer/audience config by amoghrajesh · Pull Request #61278 · apache/airflow

amoghrajesh · 2026-01-31T05:08:49Z

Was generative AI tooling used to co-author this PR?

Yes (please specify the tool below)

PyJWT released 2.11.0 https://pyjwt.readthedocs.io/en/stable/changelog.html#v2-11-0 which adds stricter validation for JWT claims.

The change: jpadilla/pyjwt#1039 and jpadilla/pyjwt#1040 ensures that the iss and aud claims must me StringOrURI as per RFC 7519: https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.1

An example of earlier behaviour with 2.10.1 pyjwt

jwt.encode({"iss": []}, key, algorithm="HS256")
Out[9]: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOltdfQ.-iVQNepE7AkWkxP2IyS2A8YlkvsSpgHKFoGElirCGSQ'
jwt.encode({"iss": 123}, "XdHWZSEDZw1KS+qP1ggxDQ==", algorithm="HS256") 
Out[10]: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOjEyM30.segFYHCUVHVGM6RbSGnqSJXnUNObaTwQGex_YMFn5IY'

With 2.11.0 pyjwt:

jwt.encode({"iss": 123}, "XdHWZSEDZw1KS+qP1ggxDQ==", algorithm="HS256") 
Traceback (most recent call last):
  File "/Users/amoghdesai/Documents/OSS/repos/airflow/.venv/lib/python3.13/site-packages/IPython/core/interactiveshell.py", line 3701, in run_code
    exec(code_obj, self.user_global_ns, self.user_ns)
    ~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "<ipython-input-7-3b5e0f6758f3>", line 1, in <module>
    jwt.encode({"iss": 123}, "XdHWZSEDZw1KS+qP1ggxDQ==", algorithm="HS256")
    ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/amoghdesai/Documents/OSS/repos/airflow/.venv/lib/python3.13/site-packages/jwt/api_jwt.py", line 145, in encode
    raise TypeError("Issuer (iss) must be a string.")
TypeError: Issuer (iss) must be a string.
jwt.encode({"iss": []}, key, algorithm="HS256")
Traceback (most recent call last):
  File "/Users/amoghdesai/Documents/OSS/repos/airflow/.venv/lib/python3.13/site-packages/IPython/core/interactiveshell.py", line 3701, in run_code
    exec(code_obj, self.user_global_ns, self.user_ns)
    ~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "<ipython-input-8-320ea77fa0bd>", line 1, in <module>
    jwt.encode({"iss": []}, key, algorithm="HS256")
    ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/amoghdesai/Documents/OSS/repos/airflow/.venv/lib/python3.13/site-packages/jwt/api_jwt.py", line 145, in encode
    raise TypeError("Issuer (iss) must be a string.")
TypeError: Issuer (iss) must be a string.

Now, airflow's config parser returned [] for unset configs when first_only was set. This is now rejected by PyJWT as invalid claims.

The fix is to return None for unset configs when single string is expected and for list values empty list is still valid -- this needs to be handled in the _conf_list_factory as well as the JWTGenerator to handle falsy values.

Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
When adding dependency, check compliance with the ASF 3rd Party License Policy.
For significant user-facing changes create newsfragment: {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

tirkarthi · 2026-01-31T07:00:55Z

The mypy error could be due to jpadilla/pyjwt@29fbfc3 where dict[str, Any] was changed to Options | None in many signatures.

jpadilla/pyjwt@29fbfc3#diff-6893ad4a1c5a36b8af3028db8c8bc3b62418149843fc382faf901eaab008e380L30

jpadilla/pyjwt@29fbfc3#diff-6893ad4a1c5a36b8af3028db8c8bc3b62418149843fc382faf901eaab008e380L204

amoghrajesh · 2026-01-31T07:24:49Z

Yep its likely that. I tried to resolve it

amoghrajesh · 2026-01-31T08:05:52Z

@tirkarthi do you wanna take another look now? Mypy is fixed.

tirkarthi

LGTM. Thanks @amoghrajesh .

potiuk

Nice!

bugraoz93 · 2026-01-31T14:51:57Z

Nice, thanks @amoghrajesh!

) * Fix JWT token generation with unset issuer/audience config * Fix JWT token generation with unset issuer/audience config

bugraoz93 · 2026-02-01T18:32:33Z

This needs a backport, seeing the similar issue. Will create in a moment

apache#61278) * Fix JWT token generation with unset issuer/audience config * Fix JWT token generation with unset issuer/audience config (cherry picked from commit a440d1d) Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com>

#61278) (#61331) * Fix JWT token generation with unset issuer/audience config (cherry picked from commit a440d1d) Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com>

) * Fix JWT token generation with unset issuer/audience config * Fix JWT token generation with unset issuer/audience config

#61278) (#61331) * Fix JWT token generation with unset issuer/audience config (cherry picked from commit a440d1d) Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com>

eladkal · 2026-02-03T07:55:11Z

cc @ephraimbuddy given rc2 we need to change milestone on this PR to 3.1.7 right?

ephraimbuddy · 2026-02-03T07:57:55Z

cc @ephraimbuddy given rc2 we need to change milestone on this PR to 3.1.7 right?

I have done so on the backport: #61331
Need to do same here too

* [v3-1-test] Add Keycloak token documentation to Security/API (#61228) (#61248) (cherry picked from commit bb04b5d) Co-authored-by: Bugra Ozturk <bugraoz93@users.noreply.github.com> * [v3-1-test] Fix language selector state not updating on change (#61060) (#61263) (cherry picked from commit 975cfe6) * [v3-1-test] Clarify template context for asset-triggered DAGs in airflow-core docs (#61258) (#61282) (cherry picked from commit f7aa502) Co-authored-by: Rachana Dutta <rupss2105@gmail.com> Co-authored-by: kevinhongzl <zhenlun.hong01@gmail.com> * [v3-1-test] Fix flaky OTel integration test with DNS health check (#61070) (#61242) (#61286) * Fix flaky OTel integration test with DNS health check (#61070) * Update airflow-core/tests/integration/otel/test_otel.py --------- (cherry picked from commit 8ac25dd) Co-authored-by: Abhishek Mishra <mishra.abhishek2808@gmail.com> Co-authored-by: Henry Chen <henryhenry0512@gmail.com> * [v3-1-test] Update pmc verification docs (#61271) (#61294) * Update Helm Chart release instructions for PMC Checks * Update KEY download instructions for PMC Checks * Update dev/README_RELEASE_HELM_CHART.md (cherry picked from commit c74b24a) * [v3-1-test] update version for release command (#61260) (#61328) (cherry picked from commit 7790482) Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com> * CI: Upgrade important CI environment (#61327) * [v3-1-test] Fix JWT token generation with unset issuer/audience config (#61278) (#61331) * Fix JWT token generation with unset issuer/audience config (cherry picked from commit a440d1d) Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com> * [v3-1-test] Remove empty `apache_airflow_site.py` file (#61308) (cherry picked from commit d65ff01) Co-authored-by: Jed Cunningham <66968678+jedcunningham@users.noreply.github.com> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Bugra Ozturk <bugraoz93@users.noreply.github.com> Co-authored-by: Guan-Ming (Wesley) Chiu <105915352+guan404ming@users.noreply.github.com> Co-authored-by: Shahar Epstein <60007259+shahar1@users.noreply.github.com> Co-authored-by: Rachana Dutta <rupss2105@gmail.com> Co-authored-by: kevinhongzl <zhenlun.hong01@gmail.com> Co-authored-by: Abhishek Mishra <mishra.abhishek2808@gmail.com> Co-authored-by: Henry Chen <henryhenry0512@gmail.com> Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com> Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com> Co-authored-by: Jed Cunningham <66968678+jedcunningham@users.noreply.github.com>

) * Fix JWT token generation with unset issuer/audience config * Fix JWT token generation with unset issuer/audience config

* [v3-1-test] Add Keycloak token documentation to Security/API (#61228) (#61248) (cherry picked from commit bb04b5d) Co-authored-by: Bugra Ozturk <bugraoz93@users.noreply.github.com> * [v3-1-test] Fix language selector state not updating on change (#61060) (#61263) (cherry picked from commit 975cfe6) * [v3-1-test] Clarify template context for asset-triggered DAGs in airflow-core docs (#61258) (#61282) (cherry picked from commit f7aa502) Co-authored-by: Rachana Dutta <rupss2105@gmail.com> Co-authored-by: kevinhongzl <zhenlun.hong01@gmail.com> * [v3-1-test] Fix flaky OTel integration test with DNS health check (#61070) (#61242) (#61286) * Fix flaky OTel integration test with DNS health check (#61070) * Update airflow-core/tests/integration/otel/test_otel.py --------- (cherry picked from commit 8ac25dd) Co-authored-by: Abhishek Mishra <mishra.abhishek2808@gmail.com> Co-authored-by: Henry Chen <henryhenry0512@gmail.com> * [v3-1-test] Update pmc verification docs (#61271) (#61294) * Update Helm Chart release instructions for PMC Checks * Update KEY download instructions for PMC Checks * Update dev/README_RELEASE_HELM_CHART.md (cherry picked from commit c74b24a) * [v3-1-test] update version for release command (#61260) (#61328) (cherry picked from commit 7790482) Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com> * CI: Upgrade important CI environment (#61327) * [v3-1-test] Fix JWT token generation with unset issuer/audience config (#61278) (#61331) * Fix JWT token generation with unset issuer/audience config (cherry picked from commit a440d1d) Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com> * [v3-1-test] Remove empty `apache_airflow_site.py` file (#61308) (cherry picked from commit d65ff01) Co-authored-by: Jed Cunningham <66968678+jedcunningham@users.noreply.github.com> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Bugra Ozturk <bugraoz93@users.noreply.github.com> Co-authored-by: Guan-Ming (Wesley) Chiu <105915352+guan404ming@users.noreply.github.com> Co-authored-by: Shahar Epstein <60007259+shahar1@users.noreply.github.com> Co-authored-by: Rachana Dutta <rupss2105@gmail.com> Co-authored-by: kevinhongzl <zhenlun.hong01@gmail.com> Co-authored-by: Abhishek Mishra <mishra.abhishek2808@gmail.com> Co-authored-by: Henry Chen <henryhenry0512@gmail.com> Co-authored-by: Rahul Vats <43964496+vatsrahul1001@users.noreply.github.com> Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com> Co-authored-by: Jed Cunningham <66968678+jedcunningham@users.noreply.github.com>

Fix JWT token generation with unset issuer/audience config

ed17e6f

amoghrajesh requested a review from vincbeck as a code owner January 31, 2026 05:08

boring-cyborg bot added the area:API Airflow's REST/HTTP API label Jan 31, 2026

amoghrajesh requested review from ashb, kaxil, potiuk and tirkarthi January 31, 2026 05:09

amoghrajesh self-assigned this Jan 31, 2026

amoghrajesh mentioned this pull request Jan 31, 2026

apache-airflow-providers-fab broke with pyjwt 2.11.0 #61270

Closed

2 tasks

eladkal approved these changes Jan 31, 2026

View reviewed changes

Fix JWT token generation with unset issuer/audience config

6bec9d0

amoghrajesh mentioned this pull request Jan 31, 2026

[main] Upgrade important CI environment #61276

Merged

1 task

shahar1 approved these changes Jan 31, 2026

View reviewed changes

tirkarthi approved these changes Jan 31, 2026

View reviewed changes

potiuk reviewed Jan 31, 2026

View reviewed changes

potiuk approved these changes Jan 31, 2026

View reviewed changes

potiuk merged commit a440d1d into apache:main Jan 31, 2026
131 checks passed

bugraoz93 mentioned this pull request Feb 1, 2026

[v3-1-test] Fix JWT token generation with unset issuer/audience config #61331

Merged

1 task

eladkal added this to the Airflow 3.1.8 milestone Feb 2, 2026

ephraimbuddy modified the milestones: Airflow 3.1.8, Airflow 3.1.7 Feb 3, 2026

choo121600 mentioned this pull request Feb 3, 2026

Add JWT issuer config to docker-compose and breeze environment #61385

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix JWT token generation with unset issuer/audience config#61278

Fix JWT token generation with unset issuer/audience config#61278
potiuk merged 2 commits intoapache:mainfrom
amoghrajesh:bump-jwt

amoghrajesh commented Jan 31, 2026

Uh oh!

tirkarthi commented Jan 31, 2026

Uh oh!

amoghrajesh commented Jan 31, 2026

Uh oh!

amoghrajesh commented Jan 31, 2026

Uh oh!

tirkarthi left a comment

Uh oh!

potiuk left a comment

Uh oh!

Uh oh!

bugraoz93 commented Jan 31, 2026

Uh oh!

bugraoz93 commented Feb 1, 2026

Uh oh!

eladkal commented Feb 3, 2026

Uh oh!

ephraimbuddy commented Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Conversation

amoghrajesh commented Jan 31, 2026

Was generative AI tooling used to co-author this PR?

Uh oh!

tirkarthi commented Jan 31, 2026

Uh oh!

amoghrajesh commented Jan 31, 2026

Uh oh!

amoghrajesh commented Jan 31, 2026

Uh oh!

tirkarthi left a comment

Choose a reason for hiding this comment

Uh oh!

potiuk left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bugraoz93 commented Jan 31, 2026

Uh oh!

bugraoz93 commented Feb 1, 2026

Uh oh!

eladkal commented Feb 3, 2026

Uh oh!

ephraimbuddy commented Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants