[v3-0-test] Update run-behind-proxy doc for CSP (#50236)

pierrejeambrun · kaxil · Your Name · commit a8ffd38aeca3 · 2025-05-06T13:27:10.000Z
* Update run-behind-proxy doc for CSP * Update airflow-core/docs/howto/run-behind-proxy.rst --------- (cherry picked from commit 468bfe3) Co-authored-by: Pierre Jeambrun <pierrejbrun@gmail.com> Co-authored-by: Kaxil Naik <kaxilnaik@gmail.com>
diff --git a/airflow-core/docs/howto/run-behind-proxy.rst b/airflow-core/docs/howto/run-behind-proxy.rst
@@ -51,6 +51,11 @@ To do so, you need to set the following setting in your ``airflow.cfg``::
         }
       }
 
+- Some parts of the UI are rendered inside iframes (Auth managers security links for instance), you need to make sure that you are not setting a restricted CSP for iframe rendering
+  such as ``frame-ancestors 'none'``. You can set the CSP header in your reverse proxy configuration, for example::
+
+      add_header Content-Security-Policy "frame-ancestors 'self';";
+
 - Use ``--proxy-headers`` CLI flag to tell Uvicorn to respect these headers: ``airflow api-server --proxy-headers``
 
 - If your proxy server is not on the same host (or in the same docker container) as Airflow, then you will need to

Original file line number	Diff line number	Diff line change
@@ -51,6 +51,11 @@ To do so, you need to set the following setting in your ``airflow.cfg``::
`51`	`51`	`}`
`52`	`52`	`}`
`53`	`53`
	`54`	`+- Some parts of the UI are rendered inside iframes (Auth managers security links for instance), you need to make sure that you are not setting a restricted CSP for iframe rendering`
	`55`	+ such as ``frame-ancestors 'none'``. You can set the CSP header in your reverse proxy configuration, for example::
	`56`	`+`
	`57`	`+ add_header Content-Security-Policy "frame-ancestors 'self';";`
	`58`	`+`
`54`	`59`	- Use ``--proxy-headers`` CLI flag to tell Uvicorn to respect these headers: ``airflow api-server --proxy-headers``
`55`	`60`
`56`	`61`	`- If your proxy server is not on the same host (or in the same docker container) as Airflow, then you will need to`