Repository: apache/airflow
File: providers/fab/src/airflow/providers/fab/auth_manager/views/auth_oauth.py (Python)

Code before:
        committed to the session backend (cookie or database) before redirecting
        the user to the UI.

        This prevents the race condition where the UI makes API requests before
        the session is available, causing temporary 401 errors during login.

        Args:
            provider: OAuth provider name (e.g., 'azure', 'google', 'github')

        Returns:
            Flask response object (redirect to original URL or home page)
        """
        log.debug("OAuth callback received for provider: %s", provider)

        # Call parent's OAuth callback handling
        # This processes the OAuth response, authenticates the user, and sets session data
        response = super().oauth_authorized(provider)

        # Explicitly commit the Flask session to ensure it's persisted
        # This is critical for the race condition fix
        session_backend = conf.get("fab", "SESSION_BACKEND", fallback="securecookie")

        if session_backend == "database":
            # For database sessions, Flask-Session automatically handles commit
            # but we explicitly mark the session as modified to ensure it's saved
            session.modified = True
            log.debug("Marked session as modified for database backend")
        else:
            # For securecookie sessions, session is automatically encoded into cookie
            # but we still mark it as modified to ensure fresh encoding
            session.modified = True
            log.debug("Marked session as modified for securecookie backend")

        # The session will be saved when this request completes, before the redirect
        # response is sent to the client. Flask's session interface handles this
        # automatically via the after_request handler

        log.debug("OAuth authentication completed successfully for provider: %s", provider)

        return response


Review comment (bug):
Looks like this message will be logged even when when authentication fails. `oauth_authorized` might not always raise in that scenario. Perhaps, this would be more accurate:

`log.debug("OAuth callback handling completed for provider: %s", provider)`

Code after:
        committed to the session backend (cookie or database) before redirecting
        the user to the UI.

        This prevents the race condition where the UI makes API requests before
        the session is available, causing temporary 401 errors during login.

        Args:
            provider: OAuth provider name (e.g., 'azure', 'google', 'github')

        Returns:
            Flask response object (redirect to original URL or home page)
        """
        log.debug("OAuth callback received for provider: %s", provider)

        # Call parent's OAuth callback handling
        # This processes the OAuth response, authenticates the user, and sets session data
        response = super().oauth_authorized(provider)

        # Explicitly mark the Flask session as modified to ensure it's persisted
        # before the redirect response is sent to the client
        session.modified = True
        session_backend = conf.get("fab", "SESSION_BACKEND", fallback="securecookie")
        log.debug("Marked session as modified for %s backend", session_backend)

        log.debug("OAuth callback handling completed for provider: %s", provider)

        return response