Explore alternatives to putting JWT token in query params

[jedcunningham]

Body

During review of an unrelated PR, it came up that having the JWT token set by putting it into query params is likely not what we want to do - it'll end up in access logs! See here.

We should refactor this.

Committer

• I acknowledge that I am a maintainer/committer of the Apache Airflow project.

[gopidesupavan]

Would think of two options 1. cookies 2. Headers ?

[gopidesupavan]

at my workplace we use authorization headers.

[amoghrajesh]

I can think of authorisation headers being a good place for this.

I think cookies are a worse option here. An example threat matrix why cookies aren't great

Source: https://curity.medium.com/best-practices-for-storing-access-tokens-in-the-browser-6b3d515d9814

[phanikumv]

@gopidesupavan do you have some available bandwidth to work on this?

[gopidesupavan]

I will take a look.

[gopidesupavan]

@vincbeck just checking, have seen discussion in dev list about JWT , is that something this issue covers already or you have plan to include?