Deprecate session auth backend (#42911)

airflow/api/auth/backend/session.py

@@ -18,15 +18,23 @@
 
 from __future__ import annotations
 
+import warnings
 from functools import wraps
 from typing import Any, Callable, TypeVar, cast
 
 from flask import Response
 
+from airflow.exceptions import RemovedInAirflow3Warning
 from airflow.www.extensions.init_auth_manager import get_auth_manager
 
 CLIENT_AUTH: tuple[str, str] | Any | None = None
 
+warnings.warn(
+    "This module is deprecated. Please use `airflow.providers.fab.auth_manager.api.auth.backend.session` instead.",
+    RemovedInAirflow3Warning,
+    stacklevel=2,
+)
+
 
 def init_app(_):
     """Initialize authentication backend."""

tests/api_connexion/test_auth.py

@@ -21,6 +21,7 @@
 import pytest
 from flask_login import current_user
 
+from airflow.exceptions import RemovedInAirflow3Warning
 from tests.test_utils.api_connexion_utils import assert_401
 from tests.test_utils.config import conf_vars
 from tests.test_utils.db import clear_db_pools
@@ -137,7 +138,8 @@ def with_session_backend(self, minimal_app_for_api):
 
         try:
             with conf_vars({("api", "auth_backends"): "airflow.api.auth.backend.session"}):
-                init_api_experimental_auth(minimal_app_for_api)
+                with pytest.warns(RemovedInAirflow3Warning):
+                    init_api_experimental_auth(minimal_app_for_api)
                 yield
         finally:
             setattr(minimal_app_for_api, "api_auth", old_auth)
@@ -174,6 +176,7 @@ def test_failure(self):
             assert_401(response)
 
 
+@pytest.mark.filterwarnings("default::airflow.exceptions.RemovedInAirflow3Warning")
 class TestSessionWithBasicAuthFallback(BaseTestAuth):
     @pytest.fixture(autouse=True, scope="class")
     def with_basic_auth_backend(self, minimal_app_for_api):