HTTP Headers Configuration on config.py not overriding. about superset HOT 3 CLOSED

To address the issue with the "X-Frame-Options" header not being overridden as expected in Superset v3.1.3, consider using the EmbeddedDashboard model's allow_domain_list attribute for a more secure and maintainable solution. This approach allows specifying domains permitted to embed a dashboard, offering granular control over embedding permissions without directly manipulating HTTP headers.

Here's a brief guide:

1. Ensure your dashboard is linked with an EmbeddedDashboard configuration in the database.
2. Use the allow_domain_list attribute to include domains you wish to allow for embedding, such as "http://localhost:5173".

This method is preferable for managing embedding permissions and mitigates potential security risks associated with improper HTTP header configurations.

Regarding the configurations OVERRIDE_HTTP_HEADERS, HTTP_HEADERS, and DEFAULT_HTTP_HEADERS, their order of precedence is as follows:

1. OVERRIDE_HTTP_HEADERS
2. HTTP_HEADERS
3. DEFAULT_HTTP_HEADERS

OVERRIDE_HTTP_HEADERS will override any settings in HTTP_HEADERS and DEFAULT_HTTP_HEADERS, with HTTP_HEADERS taking precedence over DEFAULT_HTTP_HEADERS. This setup ensures that your most critical overrides are always prioritized.

For more detailed implementation, refer to the Superset repository, specifically the files related to the EmbeddedDashboard model and the config.py for HTTP headers configuration.

To continue the conversation, mention @dosu.

from superset.

I found out the solution, I had to configure Talisman like this on config.py:
TALISMAN_ENABLED = True
TALISMAN_DEV_CONFIG = {
...
"frame_options": 'ALLOWALL',
'frame_options_allow_from': '*',
}

from superset.

Curious why you closed it... did the bot help? We're still trying to figure out how useful it is :)

from superset.