AIP-84 Token Invalidation

[pierrejeambrun]

Body

Handle token invalidation flow.

When a user log out of the application his current token should be invalidated.

Committer

• I acknowledge that I am a maintainer/committer of the Apache Airflow project.

[pierrejeambrun]

Not sure if this is required for 3.0, timing seem short.

[rawwar]

@pierrejeambrun , I was looking into this.

One idea is, whenever user logs out, we add their tokens to a temporary blacklist. This blacklist keeps cleaning up tokens which are expired. However, I can't just maintain these blacklisted tokens in memory as webserver can restart. Just a restart can re-allow these blacklisted tokens. So, this needs to be persisted. Also, if multiple replicas of the web server are running, this needs to be shared among them. Only way I can store this such that multiple webserver's can consistently get correct blacklisted tokens is to store them in metadata DB.