You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "sfirke (via GitHub)" <gi...@apache.org> on 2025/09/30 16:47:40 UTC
[I] Redirect flow for not-logged-in users attempting to view a dashboard has broken [superset]
sfirke opened a new issue, #35344:
URL: https://github.com/apache/superset/issues/35344
### Bug description
The enhancement previously merged in #30380 was broken in two places, as far as I can tell:
1. A [PR last week](https://github.com/apache/superset/pull/35237/files#diff-76c6a0b5c14a297c62ac3207416870471affdb153c5ae12b96d7b7da9304e9ddL797-R772) now just throws a 404 if a user doesn't have access to a dashboard. If not logged in, a login should be attempted first, passing the target URL as a `next` parameter.
2. The massive theming PR #31590 moved Login CRUD functionality into Superset, instead of relying on FAB. That may be what caused the `next` URL parameter to be lost during the roundtrip to the SSO provider.
The prior behavior should be restored: if an anonymous user tries to view a dashboard (whether or not it exists), they should be prompted to log in. Upon completing login, then the dashboard access check is performed and they are granted or denied as normal.
### Screenshots/recordings
_No response_
### Superset version
master / latest-dev
### Python version
3.9
### Node version
16
### Browser
Chrome
### Additional context
_No response_
### Checklist
- [ ] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [ ] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [ ] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Redirect flow for not-logged-in users attempting to view a dashboard has broken [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #35344:
URL: https://github.com/apache/superset/issues/35344#issuecomment-3353035614
<!-- Answer -->
You're correct that the redirect flow for not-logged-in users trying to view a dashboard has regressed. The intended behavior—redirecting anonymous users to the login page with a `next` parameter, then checking access after login—was implemented in [PR #30380](https://github.com/apache/superset/pull/30380), which updated the dashboard view logic to handle this flow.
However, [PR #35237](https://github.com/apache/superset/pull/35237) refactored error handling for dashboard access denial, switching to safer URL construction and removing flash messaging. This change may have inadvertently caused the 404 response or broken the login redirect with the `next` parameter, especially in SSO scenarios.
The current dashboard access logic in `superset/views/core.py` still attempts to redirect anonymous users to the login page with the `next` parameter when access is denied, but the login view in `superset/views/auth.py` does not explicitly handle or propagate the `next` parameter after authentication. This gap likely causes the loss of the intended redirect after SSO or theming changes, as the new login flow (migrated from FAB in PR #31590) doesn't replicate the nuanced handling of `next` for SSO/OAuth/SAML flows [(source)](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/views/core.py).
There are related issues and discussions about this pattern and its regressions, but no open tickets specifically track this exact bug in the latest master. The code and recent PRs confirm the regression and the likely cause: missing or incomplete handling of the `next` parameter in the new login/auth flow, especially after SSO roundtrips [(source)](https://github.com/apache/superset/issues/25794).
If you need to restore the prior behavior, focus on ensuring the login view and any SSO/OAuth handlers correctly propagate the `next` parameter after authentication, so users are redirected to their original dashboard destination post-login.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/35e4e0c4-2dc6-4f7f-9487-039a67527d33?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/35e4e0c4-2dc6-4f7f-9487-039a67527d33?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/35e4e0c4-2dc6-4f7f-9487-039a67527d33?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/35e4e0c4-2dc6-4f7f-9487-039a67527d33?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/35e4e0c4-2dc6-4f7f-9487-039a67527d33?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/35e4e0c4-2dc6-4f7f-9487-039a67527d33?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/35e4e0c4-2dc6-4f7f-9487-039a67527d33?feedback_type=other)</sup> [](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=githu
b) [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/issues/35344)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Redirect flow for not-logged-in users attempting to view a dashboard has broken [superset]
Posted by "sfirke (via GitHub)" <gi...@apache.org>.
sfirke closed issue #35344: Redirect flow for not-logged-in users attempting to view a dashboard has broken
URL: https://github.com/apache/superset/issues/35344
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Redirect flow for not-logged-in users attempting to view a dashboard has broken [superset]
Posted by "sfirke (via GitHub)" <gi...@apache.org>.
sfirke commented on issue #35344:
URL: https://github.com/apache/superset/issues/35344#issuecomment-3412746754
@sadpandajoe the fix for this is merged - would you be able to cherry into 6.0.0? 🙏
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org