[AIRFLOW-2884] Fix Flask SECRET_KEY security issue in www_rbac (apache#3729)

XD-DENG · kaxil · commit b3711ff24059 · 2020-12-04T00:46:33.000Z
The same issue was fixed for /www previously in PR apache#3651 (JIRA ticket 2809) (cherry picked from commit fe6d00a) (cherry picked from commit a8900fa) (cherry picked from commit 5b08ec2c3b5b0e67dcdd176a5b3ecbd6f0318a6e)
diff --git a/airflow/config_templates/config.yml b/airflow/config_templates/config.yml
@@ -702,7 +702,8 @@
     - name: secret_key
       description: |
         Secret key used to run your flask app
-        It should be as random as possible
+        If default value is given ("temporary_key"), a random secret_key will be generated
+        when you launch your webserver for security reason
       version_added: ~
       type: string
       example: ~
diff --git a/airflow/config_templates/default_airflow.cfg b/airflow/config_templates/default_airflow.cfg
@@ -341,7 +341,8 @@ worker_refresh_batch_size = 1
 worker_refresh_interval = 30
 
 # Secret key used to run your flask app
-# It should be as random as possible
+# If default value is given ("temporary_key"), a random secret_key will be generated
+# when you launch your webserver for security reason
 secret_key = temporary_key
 
 # Number of workers to run the Gunicorn web server
diff --git a/airflow/www_rbac/app.py b/airflow/www_rbac/app.py
@@ -19,6 +19,7 @@
 #
 import logging
 import socket
+import os
 from datetime import timedelta
 from typing import Any
 
@@ -61,6 +62,11 @@ def create_app(config=None, session=None, testing=False, app_name="Airflow"):
     session_lifetime_days = conf.getint('webserver', 'SESSION_LIFETIME_DAYS', fallback=30)
     app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(days=session_lifetime_days)
 
+    if conf.get('webserver', 'SECRET_KEY') == "temporary_key":
+        app.secret_key = os.urandom(16)
+    else:
+        app.secret_key = conf.get('webserver', 'SECRET_KEY')
+
     app.config.from_pyfile(settings.WEBSERVER_CONFIG, silent=True)
     app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
     app.config['APP_NAME'] = app_name
