You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "ambarishp (via GitHub)" <gi...@apache.org> on 2025/05/08 03:56:14 UTC
[D] CSR FError: 400 Bad Request for /superset/log/?explode=events&dashboard_id= [superset]
GitHub user ambarishp created a discussion: CSR FError: 400 Bad Request for /superset/log/?explode=events&dashboard_id=
Currently we are using superset version 4.1.2. In superset app logs , keep getting below error for /log api, every time access the dashboard. There is no impact on dashboard loading. How can avoid this error permanently
Error:
flask_wtf.csrf.CSRFError: 400 Bad Request: The CSRF token is missing.
10.244.2.64 - - [03/May/2025:22:28:18 +0530] "POST /superset/log/?explode=events&dashboard_id=106 HTTP/1.1" 302 219 "https://domainname/superset/cntl-board/?standalone=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
10.244.50.0 - - [03/May/2025:22:28:18 +0530] "GET /login/ HTTP/1.1" 302 207 "https://domainname/superset/dashboard/cntl-board/?standalone=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
10.244.175.128 - - [03/May/2025:22:28:23 +0530] "GET /login/ HTTP/1.1" 302 207 "https://domainname/superset/dashboard/cntl-board/?standalone=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
10.244.182.226 - - [03/May/2025:22:28:23 +0530] "GET / HTTP/1.1" 302 301 "https://domainname/superset/dashboard/cntl-board/?standalone=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
2025-05-03 22:28:26,406:INFO:flask_wtf.csrf:The CSRF token is missing.
2025-05-03 22:28:26,407:WARNING:superset.views.error_handling:Refresh CSRF token error
Traceback (most recent call last):
File "/usr/local/lib/python3.11/site-packages/flask_wtf/csrf.py", line 261, in protect
validate_csrf(self._get_csrf_token())
File "/usr/local/lib/python3.11/site-packages/flask_wtf/csrf.py", line 100, in validate_csrf
raise ValidationError("The CSRF token is missing.")
GitHub link: https://github.com/apache/superset/discussions/33386
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] CSR FError: 400 Bad Request for /superset/log/?explode=events&dashboard_id= [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: CSR FError: 400 Bad Request for /superset/log/?explode=events&dashboard_id=
<!-- Answer -->
I found a similar discussion titled "[400 Bad Request: The CSRF session token is missing](https://github.com/apache/superset/discussions/32815)" which is currently open <sup>[[1]](https://github.com/apache/superset/discussions/32815)</sup>. Additionally, there is a closed issue that suggests a solution for CSRF token errors: disabling CSRF protection by setting `TALISMAN_ENABLED` to `False`. This can be done by adding `TALISMAN_ENABLED: "False"` to `extraEnv` in `values.yaml` if using a Helm chart, or by directly modifying the `superset/config.py` file to set `TALISMAN_ENABLED = False` <sup>[[2]](https://github.com/apache/superset/issues/22873)</sup>.
However, disabling CSRF protection can have security implications, as it removes a layer of protection against Cross-Site Request Forgery attacks. If you choose to disable it, ensure that your application is otherwise secure and that you understand the potential risks. Alternatively, you might want to investigate why the CSRF token is missing and ensure that the token is correctly generated and included in requests.
<!-- Dosu Comment Footer -->
*To continue talking to [Dosu](https://dosu.dev), mention @dosu.*
---
<sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/c0232495-9530-4af1-94df-16eec3c345b2?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/c0232495-9530-4af1-94df-16eec3c345b2?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/c0232495-9530-4af1-94df-16eec3c345b2?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/c0232495-9530-4af1-94df-16eec3c345b2?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/c0232495-9530-4af1-94df-16eec3c345b2?feedback_type=hallucination) | [Bug Report](https://app.dosu.dev/response-feedback/c0232495-9530-4af1-94df-16eec3c345b2?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/c0232495-9530-4af1-94df-16eec3c345b2?feedback_type=other)</sup>
GitHub link: https://github.com/apache/superset/discussions/33386#discussioncomment-13070586
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] CSR FError: 400 Bad Request for /superset/log/?explode=events&dashboard_id= [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: CSR FError: 400 Bad Request for /superset/log/?explode=events&dashboard_id=
<!-- Answer -->
I found a similar discussion titled "[400 Bad Request: The CSRF session token is missing](https://github.com/apache/superset/discussions/32815)" which is currently open <sup>[[1]](https://github.com/apache/superset/discussions/32815)</sup>. Additionally, there is a closed issue that suggests a solution for CSRF token errors: disabling CSRF protection by setting `TALISMAN_ENABLED` to `False`. This can be done by adding `TALISMAN_ENABLED: "False"` to `extraEnv` in `values.yaml` if using a Helm chart, or by directly modifying the `superset/config.py` file to set `TALISMAN_ENABLED = False` <sup>[[2]](https://github.com/apache/superset/issues/22873)</sup>.
However, disabling CSRF protection can have security implications, as it removes a layer of protection against Cross-Site Request Forgery attacks. If you choose to disable it, ensure that your application is otherwise secure and that you understand the potential risks. Alternatively, you might want to investigate why the CSRF token is missing and ensure that the token is correctly generated and included in requests.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=c0232495-9530-4af1-94df-16eec3c345b2) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/33386#discussioncomment-13070586
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] CSR FError: 400 Bad Request for /superset/log/?explode=events&dashboard_id= [superset]
Posted by "ambarishp (via GitHub)" <gi...@apache.org>.
GitHub user ambarishp edited a discussion: CSR FError: 400 Bad Request for /superset/log/?explode=events&dashboard_id=
Currently we are using superset version 4.1.2. In superset app logs , keep getting below error for /log api, every time access the dashboard. There is no impact on dashboard loading. How can avoid this error permanently
Error:
flask_wtf.csrf.CSRFError: 400 Bad Request: The CSRF token is missing.
10.244.2.64 - - [03/May/2025:22:28:18 +0530] "POST /superset/log/?explode=events&dashboard_id=106 HTTP/1.1" 302 219 "https://domainname/superset/demo/?standalone=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
10.244.50.0 - - [03/May/2025:22:28:18 +0530] "GET /login/ HTTP/1.1" 302 207 "https://domainname/superset/dashboard/demo/?standalone=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
10.244.175.128 - - [03/May/2025:22:28:23 +0530] "GET /login/ HTTP/1.1" 302 207 "https://domainname/superset/dashboard/demo/?standalone=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
10.244.182.226 - - [03/May/2025:22:28:23 +0530] "GET / HTTP/1.1" 302 301 "https://domainname/superset/dashboard/demo/?standalone=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
2025-05-03 22:28:26,406:INFO:flask_wtf.csrf:The CSRF token is missing.
2025-05-03 22:28:26,407:WARNING:superset.views.error_handling:Refresh CSRF token error
Traceback (most recent call last):
File "/usr/local/lib/python3.11/site-packages/flask_wtf/csrf.py", line 261, in protect
validate_csrf(self._get_csrf_token())
File "/usr/local/lib/python3.11/site-packages/flask_wtf/csrf.py", line 100, in validate_csrf
raise ValidationError("The CSRF token is missing.")
GitHub link: https://github.com/apache/superset/discussions/33386
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] CSR FError: 400 Bad Request for /superset/log/?explode=events&dashboard_id= [superset]
Posted by "ambarishp (via GitHub)" <gi...@apache.org>.
GitHub user ambarishp edited a discussion: CSR FError: 400 Bad Request for /superset/log/?explode=events&dashboard_id=
Currently we are using superset version 4.1.2. In superset app logs , keep getting below error for /log API, every time access the dashboard. There is no impact on dashboard loading. How can avoid this error permanently. for other API's not getting this error
Error:
flask_wtf.csrf.CSRFError: 400 Bad Request: The CSRF token is missing.
10.244.2.64 - - [03/May/2025:22:28:18 +0530] "POST /superset/log/?explode=events&dashboard_id=106 HTTP/1.1" 302 219 "https://domainname/superset/demo/?standalone=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
10.244.50.0 - - [03/May/2025:22:28:18 +0530] "GET /login/ HTTP/1.1" 302 207 "https://domainname/superset/dashboard/demo/?standalone=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
10.244.175.128 - - [03/May/2025:22:28:23 +0530] "GET /login/ HTTP/1.1" 302 207 "https://domainname/superset/dashboard/demo/?standalone=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
10.244.182.226 - - [03/May/2025:22:28:23 +0530] "GET / HTTP/1.1" 302 301 "https://domainname/superset/dashboard/demo/?standalone=1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"
2025-05-03 22:28:26,406:INFO:flask_wtf.csrf:The CSRF token is missing.
2025-05-03 22:28:26,407:WARNING:superset.views.error_handling:Refresh CSRF token error
Traceback (most recent call last):
File "/usr/local/lib/python3.11/site-packages/flask_wtf/csrf.py", line 261, in protect
validate_csrf(self._get_csrf_token())
File "/usr/local/lib/python3.11/site-packages/flask_wtf/csrf.py", line 100, in validate_csrf
raise ValidationError("The CSRF token is missing.")
GitHub link: https://github.com/apache/superset/discussions/33386
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org