Comments (3)
To address the issue with the "X-Frame-Options" header not being overridden as expected in Superset v3.1.3, consider using the EmbeddedDashboard
model's allow_domain_list
attribute for a more secure and maintainable solution. This approach allows specifying domains permitted to embed a dashboard, offering granular control over embedding permissions without directly manipulating HTTP headers.
Here's a brief guide:
- Ensure your dashboard is linked with an
EmbeddedDashboard
configuration in the database. - Use the
allow_domain_list
attribute to include domains you wish to allow for embedding, such as"http://localhost:5173"
.
This method is preferable for managing embedding permissions and mitigates potential security risks associated with improper HTTP header configurations.
Regarding the configurations OVERRIDE_HTTP_HEADERS
, HTTP_HEADERS
, and DEFAULT_HTTP_HEADERS
, their order of precedence is as follows:
OVERRIDE_HTTP_HEADERS
HTTP_HEADERS
DEFAULT_HTTP_HEADERS
OVERRIDE_HTTP_HEADERS
will override any settings in HTTP_HEADERS
and DEFAULT_HTTP_HEADERS
, with HTTP_HEADERS
taking precedence over DEFAULT_HTTP_HEADERS
. This setup ensures that your most critical overrides are always prioritized.
For more detailed implementation, refer to the Superset repository, specifically the files related to the EmbeddedDashboard
model and the config.py
for HTTP headers configuration.
Details
Sources
- superset/embedded/view.py
- superset/models/embedded_dashboard.py
- superset/config.py
- superset/embedded/api.py
- superset/views/base.py
About Dosu
This response is meant to be useful and save you time. It is not meant to be a precise solution, but rather a starting point for your own research.
Help me be more useful! Please leave a π if this is helpful and π if it is irrelevant.
To continue the conversation, mention @dosu.
from superset.
I found out the solution, I had to configure Talisman like this on config.py:
TALISMAN_ENABLED = True
TALISMAN_DEV_CONFIG = {
...
"frame_options": 'ALLOWALL',
'frame_options_allow_from': '*',
}
from superset.
Curious why you closed it... did the bot help? We're still trying to figure out how useful it is :)
from superset.
Related Issues (20)
- Superset 4.0.2 : Table Chart - Column Based Total Calculation HOT 2
- Handlebars chart - pagination support HOT 2
- superset_node build failure @nx/nx-linux-x64-gnu missing module HOT 6
- Mixed chart x-axes overlap for time period of last quarter HOT 1
- Cannot get back asyncquery result HOT 3
- Dev-server page isn't rendered HOT 14
- Garbled characters on the agent page in the development environment HOT 4
- Labels of Advanced analytics stats in the chart legend can't be changed
- Ephemeral instances no longer have any example data HOT 5
- cannot use a string pattern on a bytes-like object HOT 4
- Fatal error when creating a chart from a saved_query via API call HOT 6
- Elasticsearch integration with superst (Arrays are not supported) HOT 1
- Slack Invite is Broken HOT 2
- RLS form does not show all available datasets when searching by mask HOT 1
- 4.1.0rc1 celery issue - Received unregistered task of type 'reports.scheduler'. HOT 5
- Public role is too strong by default HOT 4
- On the chart editing screen, the icon of dataset should be similar to those used on the βDatasetβ screen. HOT 2
- The description of a chart indicate "deprecated" but the graphical tag is not present
- Unuseful column in export Excel HOT 1
- Upon download as PDF, charts on a long dashboard render as loading image HOT 7
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
π Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. πππ
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google β€οΈ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from superset.