Re: [PR] docs(auth): add Keycloak PKCE, logout and group-mapping example [superset]

["codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>]

codeant-ai-for-open-source[bot] commented on PR #38092:
URL: https://github.com/apache/superset/pull/38092#issuecomment-6315359956

   ## CodeAnt PR Risk: Medium Risk
   
   - The PR needs attention before merging.
   - The documented PKCE setting remains under client_kwargs, where it may be ignored, leaving the example's OAuth flow without the promised PKCE protection.
   - Userinfo and provisioning failures in the OAuth callback are uncaught and can return server errors instead of a controlled login failure.
   - The logout redirect derives its destination from request.url_root, which can point to an internal host behind some proxies and be rejected by Keycloak.
   
   **Assessed commit:** `9c4eda85ee15`


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org