flask-jwt | JWT for Flask applications | Authentication library

By default, MWAA is constrained to using version 3.0.0 for the package apache-airflow-providers-slack. If you specify version 4.2.3 in requirements.txt, it will not be installed (error logs should be available in CloudWatch). You'll have to downgrade to version 3.0.0.

apache-airflow-providers-slack (constraints.txt)

OR

Add constraints file to the top of requirements.txt to use version 4.2.3 of apache-airflow-providers-slack.

Add the constraints file for your Apache Airflow v2 environment to the top of your requirements.txt file.

As you suggested, having some basic tables and methods + decorators is the way to go.

You can also look into how this is implemented in Flask-Security (or in packages Flask-Login and Flask-Principal, which are used in Flask-Security). It can give you some suggestions on what kind of functions you'd like to have.

flask_jwt_extended provides the get_jwt_identity() function, which returns the identity used to create the token used in the current call: create_access_token(identity=username).

Link to the documentation

So in your case, it should become something like this

I believe the reason this isn't working is because the callback method for @jwt.unauthorized_loader is already called in the context of an @app.errorhandler, and any exception raised in an errorhandler will not cause trigger other errorhandlers.

Instead of trying to handle this with aborts and exceptional control flow, why not just use a helper method to make your custom response and use it in both places?

As mentioned here:

token_in_blacklist_loader has been renamed to token_in_blocklist_loader

You need to replace @jwt.token_in_blacklist_loader with @jwt.token_in_blocklist_loader

According to the JWT spec, sub is a Subject claim:

The "sub" (subject) claim identifies the principal that is the subject of the JWT. The claims in a JWT are normally statements about the subject. The subject value MUST either be scoped to be locally unique in the context of the issuer or be globally unique. The processing of this claim is generally application specific. The "sub" value is a case-sensitive string containing a StringOrURI value. Use of this claim is OPTIONAL.

Flask-JWT-Extended's documentation says it's the default key used to store the identity (user ID).

JWT_IDENTITY_CLAIM
The claim in a JWT that is used as the source of identity. Default: "sub"

It seems that the newest version of Flask (currently 2.0.1) has problem with dependencies.

The problem was resolved after downgrading it to 1.1.2 via the following command:

It seems that you are confusing the use-cases for PythonVirtualenvOperator and PythonOperator.

If you simply want to run a Python callable in a task (callable_virtualenv() in your case) you can use PythonOperator. In this case, it does not matter if you installed Airflow in a virtual environment, system wide, or using Docker.

What happens in your code is the following: PythonVirtualenvOperator creates another virtual environment (which is completely unrelated to the one in which you run Airflow), installs Airflow into it, and tries to import Variable. But this another Airflow installation is not configured and that is why you get those exceptions. You could set the AIRFLOW_HOME environment variable for this second Airflow installation to the same directory as used by the first Airflow installation, and this should actually work, but it looks like an overkill to me.

So, what you can do is install colorama into the same environment in which you installed Airflow and replace PythonVirtualenvOperator by PythonOperator.

BTW, those print() inside the callable would be redirected into a log file and not printed to terminal, so it probably does not make much sense to use colorama with them.

Flask-JWT-Extended should never be setting the csrf cookies as httponly. I wonder if there is an nginx setting that is converting all cookies to httponly (something like proxy_cookie_path)?

If that’s the case, another approach you could take it to set JWT_CSRF_IN_COOKIES to false, and use https://flask-jwt-extended.readthedocs.io/en/stable/api/#flask_jwt_extended.get_csrf_token to grab the csrf token when a JWT is created, return it as part of the JSON payload, and store it in localStorage instead of in those non-httponly cookies so that your JavaScript can still grab it when making requests.