CSRF session token is missing in AIRFLOW

Question

I am using docker for Airflow. The docker-compose file below is mostly taken from the airflow official website. This works fine on my laptop but when I uploaded to the server, I kept getting error message when I browse around on the frontend.

Bad Request

The CSRF session token is missing.

From the document, it tells me I need to add AIRFLOW__WEBSERVER__SECRET_KEY so I added it. Is there something that I missed?

version: '3'
x-airflow-common:
  &airflow-common
  image: 
  environment:
    &airflow-common-env
    AIRFLOW__CORE__EXECUTOR: CeleryExecutor
    AIRFLOW__CORE__SQL_ALCHEMY_CONN: postgresql+psycopg2://
    AIRFLOW__CELERY__RESULT_BACKEND: db+postgresql://
    AIRFLOW__CELERY__BROKER_URL: redis://:@redis:6379/0
    AIRFLOW__CELERY__FLOWER_PORT: '5556'
    AIRFLOW__CORE__FERNET_KEY: ''
    AIRFLOW__CORE__DAGS_ARE_PAUSED_AT_CREATION: 'True'
    AIRFLOW__CORE__LOAD_EXAMPLES: 'False'
    AIRFLOW__API__AUTH_BACKEND: 'airflow.api.auth.backend.basic_auth'
    AIRFLOW__CORE__EXPOSE_CONFIG: 'True'
    AIRFLOW__CORE__REMOTE_LOGGING: 'True'
    AIRFLOW__CORE__REMOTE_BASE_LOG_FOLDER: 
    AIRFLOW__CORE__REMOTE_LOG_CONN_ID: 's3_connection'
    AIRFLOW__CORE__ENCRYPT_S3_LOGS: 'False'
    AIRFLOW__SMTP__SMTP_HOST: 'smtp.sendgrid.net'
    AIRFLOW__SMTP__SMTP_STARTTLS: 'True'
    AIRFLOW__SMTP__SMTP_SSL: 'False'
    #AIRFLOW__SMTP__SMTP_USER: 'apikey'
    #AIRFLOW__SMTP__SMTP_PASSWORD: 
    AIRFLOW__SMTP__SMTP_PORT: '587'
    AIRFLOW__SMTP__SMTP_MAIL_FROM: 
    _PIP_ADDITIONAL_REQUIREMENTS: ""
    AIRFLOW__WEBSERVER__WORKERS: '1'
    AIRFLOW__WEBSERVER__SECRET_KEY: 'secret_key'
  volumes:
    - ../dags:/opt/airflow/dags
    - ../scripts:/opt/airflow/scripts
  user: "${AIRFLOW_UID:-50000}:${AIRFLOW_GID:-50000}"
  depends_on:
    redis:
      condition: service_healthy

services:

  redis:
    image: redis:latest
    ports:
      - 6379:6379
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 30s
      retries: 50
    restart: always

  airflow-webserver:
    <<: *airflow-common
    command: webserver
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ports:
      - 8080:8080
      - 9000:9000
    healthcheck:
      test: ["CMD", "curl", "--fail", "http://localhost:8080/health"]
      interval: 10s
      timeout: 10s
      retries: 5
    restart: always

  airflow-scheduler:
    <<: *airflow-common
    command: scheduler
    healthcheck:
      test: ["CMD-SHELL", 'airflow jobs check --job-type SchedulerJob --hostname "$${HOSTNAME}"']
      interval: 10s
      timeout: 10s
      retries: 5
    restart: always

  airflow-worker:
    <<: *airflow-common
    command: celery worker
    healthcheck:
      test:
        - "CMD-SHELL"
        - 'celery --app airflow.executors.celery_executor.app inspect ping -d "celery@$${HOSTNAME}"'
      interval: 10s
      timeout: 10s
      retries: 5
    restart: always

  airflow-init:
    <<: *airflow-common
    command: version
    environment:
      <<: *airflow-common-env
      _AIRFLOW_DB_UPGRADE: 'true'
      _AIRFLOW_WWW_USER_CREATE: 'true'
      _AIRFLOW_WWW_USER_USERNAME: ${_AIRFLOW_WWW_USER_USERNAME:-airflow}
      _AIRFLOW_WWW_USER_PASSWORD: ${_AIRFLOW_WWW_USER_PASSWORD:-airflow}

  flower:
    <<: *airflow-common
    command: celery flower
    ports:
      - 5556:5556
    healthcheck:
      test: ["CMD", "curl", "--fail", "http://localhost:5556/"]
      interval: 10s
      timeout: 10s
      retries: 5
    restart: always

volumes:
  postgres-db-volume:

user_10569220 · Answer

Make sure that the value of AIRFLOW__WEBSERVER__SECRET_KEY in the worker nodes and the webserver (main node) is the same. You can find more details on this PR.

The worker node runs a webserver that handles the requests to access to exeuction logs, that why you see errors like: *** Failed to fetch log file from worker. 403 Client Error: FORBIDDEN for url: https://worker.worker or CSRF session token is missing.

In your worker, you could just add the value of the secret key to an .env file and load it in the docker-compose definition:

  environment: &airflow-common-env
    AIRFLOW__CORE__FERNET_KEY: ${FERNET_KEY}
    AIRFLOW__WEBSERVER__SECRET_KEY: ${SECRET_KEY}

  env_file:
    - .env

CSRF session token is missing in AIRFLOW

1 Answers