Move webserver config to fab provider (apache#50774)

pierrejeambrun · dadonnelly316 · commit 2eb54369cd6d · 2025-05-26T11:20:33.000-04:00
* Move webserver navbar config to fab provider

* Remove x_frame_enabled config
diff --git a/airflow-core/src/airflow/api_fastapi/core_api/datamodels/ui/config.py b/airflow-core/src/airflow/api_fastapi/core_api/datamodels/ui/config.py
@@ -24,10 +24,6 @@
 class ConfigResponse(BaseModel):
     """configuration serializer."""
 
-    navbar_color: str
-    navbar_text_color: str
-    navbar_hover_color: str
-    navbar_text_hover_color: str
     page_size: int
     auto_refresh_interval: int
     hide_paused_dags_by_default: bool
diff --git a/airflow-core/src/airflow/api_fastapi/core_api/openapi/_private_ui.yaml b/airflow-core/src/airflow/api_fastapi/core_api/openapi/_private_ui.yaml
@@ -740,18 +740,6 @@ components:
       description: Base Node serializer for responses.
     ConfigResponse:
       properties:
-        navbar_color:
-          type: string
-          title: Navbar Color
-        navbar_text_color:
-          type: string
-          title: Navbar Text Color
-        navbar_hover_color:
-          type: string
-          title: Navbar Hover Color
-        navbar_text_hover_color:
-          type: string
-          title: Navbar Text Hover Color
         page_size:
           type: integer
           title: Page Size
@@ -797,10 +785,6 @@ components:
           title: External Log Name
       type: object
       required:
-      - navbar_color
-      - navbar_text_color
-      - navbar_hover_color
-      - navbar_text_hover_color
       - page_size
       - auto_refresh_interval
       - hide_paused_dags_by_default
diff --git a/airflow-core/src/airflow/api_fastapi/core_api/routes/ui/config.py b/airflow-core/src/airflow/api_fastapi/core_api/routes/ui/config.py
@@ -31,10 +31,6 @@
 config_router = AirflowRouter(tags=["Config"])
 
 WEBSERVER_CONFIG_KEYS = [
-    "navbar_color",
-    "navbar_text_color",
-    "navbar_hover_color",
-    "navbar_text_hover_color",
     "enable_swagger_ui",
 ]
 
diff --git a/airflow-core/src/airflow/cli/commands/config_command.py b/airflow-core/src/airflow/cli/commands/config_command.py
@@ -387,6 +387,26 @@ def message(self) -> str | None:
         config=ConfigParameter("webserver", "expose_hostname"),
         renamed_to=ConfigParameter("fab", "expose_hostname"),
     ),
+    ConfigChange(
+        config=ConfigParameter("webserver", "navbar_color"),
+        renamed_to=ConfigParameter("fab", "navbar_color"),
+    ),
+    ConfigChange(
+        config=ConfigParameter("webserver", "navbar_text_color"),
+        renamed_to=ConfigParameter("fab", "navbar_text_color"),
+    ),
+    ConfigChange(
+        config=ConfigParameter("webserver", "navbar_hover_color"),
+        renamed_to=ConfigParameter("fab", "navbar_hover_color"),
+    ),
+    ConfigChange(
+        config=ConfigParameter("webserver", "navbar_text_hover_color"),
+        renamed_to=ConfigParameter("fab", "navbar_text_hover_color"),
+    ),
+    ConfigChange(
+        config=ConfigParameter("webserver", "x_frame_enabled"),
+        was_deprecated=False,
+    ),
     ConfigChange(
         config=ConfigParameter("webserver", "base_url"),
         renamed_to=ConfigParameter("api", "base_url"),
diff --git a/airflow-core/src/airflow/config_templates/config.yml b/airflow-core/src/airflow/config_templates/config.yml
@@ -1762,41 +1762,6 @@ webserver:
       sensitive: true
       example: ~
       default: "{SECRET_KEY}"
-    navbar_color:
-      description: |
-        Define the color of navigation bar
-      version_added: ~
-      type: string
-      example: ~
-      default: "#fff"
-    navbar_text_color:
-      description: |
-        Define the color of text in the navigation bar
-      version_added: 2.8.0
-      type: string
-      example: ~
-      default: "#51504f"
-    navbar_hover_color:
-      description: |
-        Define the color of navigation bar links when hovered
-      version_added: 2.9.0
-      type: string
-      example: ~
-      default: "#eee"
-    navbar_text_hover_color:
-      description: |
-        Define the color of text in the navigation bar when hovered
-      version_added: 2.9.0
-      type: string
-      example: ~
-      default: "#51504f"
-    x_frame_enabled:
-      description: |
-        Allow the UI to be rendered in a frame
-      version_added: 1.10.8
-      type: boolean
-      example: ~
-      default: "True"
     instance_name:
       description: |
         Sets a custom page title for the DAGs overview page and site title for all pages
diff --git a/airflow-core/src/airflow/configuration.py b/airflow-core/src/airflow/configuration.py
@@ -358,6 +358,10 @@ def sensitive_config_values(self) -> set[tuple[str, str]]:
         ("api", "expose_config"): ("webserver", "expose_config", "3.0.1"),
         ("fab", "access_denied_message"): ("webserver", "access_denied_message", "3.0.2"),
         ("fab", "expose_hostname"): ("webserver", "expose_hostname", "3.0.2"),
+        ("fab", "navbar_color"): ("webserver", "navbar_color", "3.0.2"),
+        ("fab", "navbar_text_color"): ("webserver", "navbar_text_color", "3.0.2"),
+        ("fab", "navbar_hover_color"): ("webserver", "navbar_hover_color", "3.0.2"),
+        ("fab", "navbar_text_hover_color"): ("webserver", "navbar_text_hover_color", "3.0.2"),
         ("api", "grid_view_sorting_order"): ("webserver", "grid_view_sorting_order", "3.1.0"),
         ("api", "log_fetch_timeout_sec"): ("webserver", "log_fetch_timeout_sec", "3.1.0"),
         ("api", "hide_paused_dags_by_default"): ("webserver", "hide_paused_dags_by_default", "3.1.0"),
diff --git a/airflow-core/src/airflow/ui/openapi-gen/requests/schemas.gen.ts b/airflow-core/src/airflow/ui/openapi-gen/requests/schemas.gen.ts
@@ -6002,22 +6002,6 @@ export const $BaseNodeResponse = {
 
 export const $ConfigResponse = {
   properties: {
-    navbar_color: {
-      type: "string",
-      title: "Navbar Color",
-    },
-    navbar_text_color: {
-      type: "string",
-      title: "Navbar Text Color",
-    },
-    navbar_hover_color: {
-      type: "string",
-      title: "Navbar Hover Color",
-    },
-    navbar_text_hover_color: {
-      type: "string",
-      title: "Navbar Text Hover Color",
-    },
     page_size: {
       type: "integer",
       title: "Page Size",
@@ -6083,10 +6067,6 @@ export const $ConfigResponse = {
   },
   type: "object",
   required: [
-    "navbar_color",
-    "navbar_text_color",
-    "navbar_hover_color",
-    "navbar_text_hover_color",
     "page_size",
     "auto_refresh_interval",
     "hide_paused_dags_by_default",
diff --git a/airflow-core/src/airflow/ui/openapi-gen/requests/types.gen.ts b/airflow-core/src/airflow/ui/openapi-gen/requests/types.gen.ts
@@ -1496,10 +1496,6 @@ export type type =
  * configuration serializer.
  */
 export type ConfigResponse = {
-  navbar_color: string;
-  navbar_text_color: string;
-  navbar_hover_color: string;
-  navbar_text_hover_color: string;
   page_size: number;
   auto_refresh_interval: number;
   hide_paused_dags_by_default: boolean;
diff --git a/airflow-core/src/airflow/ui/src/mocks/handlers/config.ts b/airflow-core/src/airflow/ui/src/mocks/handlers/config.ts
@@ -28,10 +28,6 @@ export const handlers: Array<HttpHandler> = [
       enable_swagger_ui: true,
       hide_paused_dags_by_default: false,
       instance_name: "Airflow",
-      navbar_color: "#fff",
-      navbar_hover_color: "#eee",
-      navbar_text_color: "#51504f",
-      navbar_text_hover_color: "#51504f",
       page_size: 15,
       require_confirmation_dag_change: false,
       test_connection: "Disabled",
diff --git a/airflow-core/tests/unit/api_fastapi/core_api/routes/ui/test_config.py b/airflow-core/tests/unit/api_fastapi/core_api/routes/ui/test_config.py
@@ -23,10 +23,6 @@
 pytestmark = pytest.mark.db_test
 
 mock_config_response = {
-    "navbar_color": "#fff",
-    "navbar_text_color": "#51504f",
-    "navbar_hover_color": "#eee",
-    "navbar_text_hover_color": "#51504f",
     "page_size": 100,
     "auto_refresh_interval": 3,
     "hide_paused_dags_by_default": True,
@@ -50,12 +46,7 @@ def mock_config_data():
     """
     with conf_vars(
         {
-            ("webserver", "navbar_color"): "#fff",
-            ("webserver", "navbar_text_color"): "#51504f",
-            ("webserver", "navbar_hover_color"): "#eee",
-            ("webserver", "navbar_text_hover_color"): "#51504f",
             ("webserver", "instance_name"): "Airflow",
-            ("webserver", "instance_name_has_markup"): "false",
             ("webserver", "enable_swagger_ui"): "true",
             ("api", "hide_paused_dags_by_default"): "true",
             ("api", "page_size"): "100",
diff --git a/providers/fab/docs/auth-manager/security.rst b/providers/fab/docs/auth-manager/security.rst
@@ -22,17 +22,6 @@ FAB auth manager UI security options
     This guide only applies to FAB auth manager UI pages. These pages are accessible under category "Security" in the
     menu.
 
-Rendering Airflow UI in a Web Frame from another site
-------------------------------------------------------
-
-Using Airflow in a web frame is enabled by default. To disable this (and prevent click jacking attacks)
-set the below:
-
-.. code-block:: ini
-
-    [webserver]
-    x_frame_enabled = False
-
 Sensitive Variable fields
 -------------------------
 
diff --git a/providers/fab/provider.yaml b/providers/fab/provider.yaml
@@ -35,6 +35,7 @@ source-date-epoch: 1747132761
 # In such case adding >= NEW_VERSION and bumping to NEW_VERSION in a provider have
 # to be done in the same PR
 versions:
+  - 2.2.0
   - 2.1.0
   - 2.0.2
   - 2.0.1
@@ -60,6 +61,34 @@ config:
   fab:
     description: This section contains configs specific to FAB provider.
     options:
+      navbar_color:
+        description: |
+          Define the color of navigation bar
+        version_added: 2.2.0
+        type: string
+        example: ~
+        default: "#fff"
+      navbar_text_color:
+        description: |
+          Define the color of text in the navigation bar
+        version_added: 2.2.0
+        type: string
+        example: ~
+        default: "#51504f"
+      navbar_hover_color:
+        description: |
+          Define the color of navigation bar links when hovered
+        version_added: 2.2.0
+        type: string
+        example: ~
+        default: "#eee"
+      navbar_text_hover_color:
+        description: |
+          Define the color of text in the navigation bar when hovered
+        version_added: 2.2.0
+        type: string
+        example: ~
+        default: "#51504f"
       access_denied_message:
         description: |
           The message displayed when a user attempts to execute actions beyond their authorised privileges.
diff --git a/providers/fab/pyproject.toml b/providers/fab/pyproject.toml
@@ -25,7 +25,7 @@ build-backend = "flit_core.buildapi"
 
 [project]
 name = "apache-airflow-providers-fab"
-version = "2.1.0"
+version = "2.2.0"
 description = "Provider package apache-airflow-providers-fab for Apache Airflow"
 readme = "README.rst"
 authors = [
@@ -127,8 +127,8 @@ apache-airflow-providers-common-sql = {workspace = true}
 apache-airflow-providers-standard = {workspace = true}
 
 [project.urls]
-"Documentation" = "https://airflow.apache.org/docs/apache-airflow-providers-fab/2.1.0"
-"Changelog" = "https://airflow.apache.org/docs/apache-airflow-providers-fab/2.1.0/changelog.html"
+"Documentation" = "https://airflow.apache.org/docs/apache-airflow-providers-fab/2.2.0"
+"Changelog" = "https://airflow.apache.org/docs/apache-airflow-providers-fab/2.2.0/changelog.html"
 "Bug Tracker" = "https://github.com/apache/airflow/issues"
 "Source Code" = "https://github.com/apache/airflow"
 "Slack Chat" = "https://s.apache.org/airflow-slack"
diff --git a/providers/fab/src/airflow/providers/fab/__init__.py b/providers/fab/src/airflow/providers/fab/__init__.py
@@ -29,7 +29,7 @@
 
 __all__ = ["__version__"]
 
-__version__ = "2.1.0"
+__version__ = "2.2.0"
 
 if packaging.version.parse(packaging.version.parse(airflow_version).base_version) < packaging.version.parse(
     "3.0.2"
diff --git a/providers/fab/src/airflow/providers/fab/get_provider_info.py b/providers/fab/src/airflow/providers/fab/get_provider_info.py
@@ -30,6 +30,34 @@ def get_provider_info():
             "fab": {
                 "description": "This section contains configs specific to FAB provider.",
                 "options": {
+                    "navbar_color": {
+                        "description": "Define the color of navigation bar\n",
+                        "version_added": "2.2.0",
+                        "type": "string",
+                        "example": None,
+                        "default": "#fff",
+                    },
+                    "navbar_text_color": {
+                        "description": "Define the color of text in the navigation bar\n",
+                        "version_added": "2.2.0",
+                        "type": "string",
+                        "example": None,
+                        "default": "#51504f",
+                    },
+                    "navbar_hover_color": {
+                        "description": "Define the color of navigation bar links when hovered\n",
+                        "version_added": "2.2.0",
+                        "type": "string",
+                        "example": None,
+                        "default": "#eee",
+                    },
+                    "navbar_text_hover_color": {
+                        "description": "Define the color of text in the navigation bar when hovered\n",
+                        "version_added": "2.2.0",
+                        "type": "string",
+                        "example": None,
+                        "default": "#51504f",
+                    },
                     "access_denied_message": {
                         "description": "The message displayed when a user attempts to execute actions beyond their authorised privileges.\n",
                         "version_added": "2.1.0",
diff --git a/providers/fab/src/airflow/providers/fab/www/app.py b/providers/fab/src/airflow/providers/fab/www/app.py
@@ -33,7 +33,7 @@
 from airflow.providers.fab.www.extensions.init_appbuilder import init_appbuilder
 from airflow.providers.fab.www.extensions.init_jinja_globals import init_jinja_globals
 from airflow.providers.fab.www.extensions.init_manifest_files import configure_manifest_files
-from airflow.providers.fab.www.extensions.init_security import init_api_auth, init_xframe_protection
+from airflow.providers.fab.www.extensions.init_security import init_api_auth
 from airflow.providers.fab.www.extensions.init_session import init_airflow_session_interface
 from airflow.providers.fab.www.extensions.init_views import (
     init_api_auth_provider,
@@ -102,7 +102,6 @@ def create_app(enable_plugins: bool):
             init_api_auth_provider(flask_app)
             init_api_error_handlers(flask_app)
         init_jinja_globals(flask_app, enable_plugins=enable_plugins)
-        init_xframe_protection(flask_app)
         init_airflow_session_interface(flask_app)
         init_wsgi_middleware(flask_app)
     return flask_app
diff --git a/providers/fab/src/airflow/providers/fab/www/extensions/init_jinja_globals.py b/providers/fab/src/airflow/providers/fab/www/extensions/init_jinja_globals.py
@@ -52,10 +52,10 @@ def prepare_jinja_globals():
         extra_globals = {
             "server_timezone": server_timezone,
             "hostname": hostname,
-            "navbar_color": conf.get("webserver", "NAVBAR_COLOR"),
-            "navbar_text_color": conf.get("webserver", "NAVBAR_TEXT_COLOR"),
-            "navbar_hover_color": conf.get("webserver", "NAVBAR_HOVER_COLOR"),
-            "navbar_text_hover_color": conf.get("webserver", "NAVBAR_TEXT_HOVER_COLOR"),
+            "navbar_color": conf.get("fab", "NAVBAR_COLOR"),
+            "navbar_text_color": conf.get("fab", "NAVBAR_TEXT_COLOR"),
+            "navbar_hover_color": conf.get("fab", "NAVBAR_HOVER_COLOR"),
+            "navbar_text_hover_color": conf.get("fab", "NAVBAR_TEXT_HOVER_COLOR"),
             "airflow_version": airflow_version,
             "git_version": git_version,
             "show_plugin_message": enable_plugins,
diff --git a/providers/fab/src/airflow/providers/fab/www/extensions/init_security.py b/providers/fab/src/airflow/providers/fab/www/extensions/init_security.py
@@ -25,25 +25,6 @@
 log = logging.getLogger(__name__)
 
 
-def init_xframe_protection(app):
-    """
-    Add X-Frame-Options header.
-
-    Use it to avoid click-jacking attacks, by ensuring that their content is not embedded into other sites.
-
-    See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
-    """
-    x_frame_enabled = conf.getboolean("webserver", "X_FRAME_ENABLED", fallback=True)
-    if x_frame_enabled:
-        return
-
-    def apply_caching(response):
-        response.headers["X-Frame-Options"] = "DENY"
-        return response
-
-    app.after_request(apply_caching)
-
-
 def init_api_auth(app):
     """Load authentication backends."""
     auth_backends = conf.get(
diff --git a/providers/fab/tests/unit/fab/decorators.py b/providers/fab/tests/unit/fab/decorators.py
diff --git a/pyproject.toml b/pyproject.toml
diff --git a/scripts/ci/pre_commit/update_airflow_pyproject_toml.py b/scripts/ci/pre_commit/update_airflow_pyproject_toml.py

Original file line number	Diff line number	Diff line change
`@@ -31,10 +31,6 @@`
`31`	`31`	`config_router = AirflowRouter(tags=["Config"])`
`32`	`32`
`33`	`33`	`WEBSERVER_CONFIG_KEYS = [`
`34`		`- "navbar_color",`
`35`		`- "navbar_text_color",`
`36`		`- "navbar_hover_color",`
`37`		`- "navbar_text_hover_color",`
`38`	`34`	`"enable_swagger_ui",`
`39`	`35`	`]`
`40`	`36`