[GitHub] [superset] dpgaspar commented on a change in pull request #17511: fix: Dashboard access when DASHBOARD_RBAC is disabled

[GitBox <gi...@apache.org>]

dpgaspar commented on a change in pull request #17511:
URL: https://github.com/apache/superset/pull/17511#discussion_r755020862



##########
File path: superset/dashboards/api.py
##########
@@ -327,6 +332,8 @@ def get_datasets(self, id_or_slug: str) -> Response:
               $ref: '#/components/responses/400'
             401:
               $ref: '#/components/responses/401'
+            403:
+              $ref: '#/components/responses/403'

Review comment:
       I'm fine with returning 403, although it's more coherent with the current setup that we return 404, note that the dashboard filter is serving has security so we only "show" resources that are available to the user. Also, exposing less detailed info about why a resource is not available for access to a user the better.
   
   RFC is not 100% clear regarding this:
   https://datatracker.ietf.org/doc/html/rfc7231#section-6.5.3
   https://datatracker.ietf.org/doc/html/rfc7231#section-6.5.4
   it's acceptable to return 404 if we don't want to disclose that the dashboard exists but it's access is forbidden to the user.
   




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org