apache/airflow

Never expose sensitive config values in UI

Closed

#59,860 opened on Dec 27, 2025

View on GitHubContributor guide
 (5 comments) (0 reactions) (0 assignees)Python (16,781 forks)batch import
area:APIarea:UIgood first issue

Repository metrics

Stars
 (44,809 stars)
PR merge metrics
 (Avg merge 7d 18h) (834 merged PRs in 30d)

Description

Body

Currently the expose config allows deployment manager to expose also sensitive data - when set to True https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html#expose-config. The non-sensitive-only value causes sensitive field masking.

With the discussion mentioned in #59838 we agreed that we should never expose sensitive data over any public API where UI user can authenticate (only via task-sdk API where tasks get dedicated JWT token)

This means that:

  • Only True/False should be expected for expose-config and True means that sensitive fields are masked
  • We should add fallback - when "non-sensitive-data" is set for the parameter it should be treated as True and deprecation warning should be raised
  • newsfragment should be added explaining the behaviour change

Committer

  • I acknowledge that I am a maintainer/committer of the Apache Airflow project.

Contributor guide

Research direction
Inspect the implementation of `expose config` in Airflow's configuration module. Understand how sensitive fields are masked in the UI and identify any code paths that may still expose sensitive data. Refer to the discussion in #59838 for context. Then modify the config to only accept True/False, add a deprecation warning for 'non sensitive only', and add a newsfragment.
Tech stack
python
Domain
backend
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
PythonGit
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70