x_frame_enabled logic broken in Airflow 2

[planoe-cloudera]

Apache Airflow version: 2.1.0

Environment:

• Cloud provider or hardware configuration: Azure
• OS (e.g. from /etc/os-release): RHEL8.3
• Kernel (e.g. uname -a): Linux 7db15dac176b 5.10.25-linuxkit # 1 SMP Tue Mar 23 09:27:39 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

What happened:

When x_frame_enabled is default or set to true, embedding Airflow is not working since X-Frame-Options is set to "DENY"

What you expected to happen:

When x_frame_enabled is default or set to true, embedding Airflow is working

How to reproduce it:
leave x_frame_enabled to default or set it to true and try to embed it in an iFrame for instance and it will not work.
Setting it to "False" is the current workaround since the if condition does not seem to be correct.

Anything else we need to know:
broken code in Airflow 2:

airflow/airflow/www/extensions/init_security.py

Line 26 in 0801322

def init_xframe_protection(app):

if x_frame_enabled is enabled it will apply the DENY header, which was not the case in Airflow 1:

airflow/airflow/www_rbac/app.py

Line 274 in d3b0669

def apply_caching(response):

since if was only setting the header in case it is NOT enabled.

[boring-cyborg]

Thanks for opening your first issue here! Be sure to follow the issue template!

[uranusjr]

Hi, would you be interested in submitting a pull request to fix this?

[artik00]

Any idea since when this was broken?

[sathoune]

@artik00 All versions from 2.0.0 were affected. The relevant code in v1 was rewritten.