You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "Dev10-34 (via GitHub)" <gi...@apache.org> on 2026/02/16 07:24:08 UTC
[D] Superset login form performing a postForm, which submits a hidden form, causing the login button not getting disabled properly [superset]
GitHub user Dev10-34 created a discussion: Superset login form performing a postForm, which submits a hidden form, causing the login button not getting disabled properly
The superset version 6.0.0 with the ported SPA login page performs a SupersetClient.postForm. However, the onFinish function is written to set loading and unset it on the request completion. However, when the request goes, being a postform request, it performs a full page navigation, leading to exiting of the SPA for a moment and then re enter SPA. This is causing the onLoading function hook and the loading variable to not function as expected.
GitHub link: https://github.com/apache/superset/discussions/38007
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset login form performing a postForm, which submits a hidden form, causing the login button not getting disabled properly [superset]
Posted by "Dev10-34 (via GitHub)" <gi...@apache.org>.
GitHub user Dev10-34 added a comment to the discussion: Superset login form performing a postForm, which submits a hidden form, causing the login button not getting disabled properly
Dang it. This would require a server level re write as well then @dosu?
GitHub link: https://github.com/apache/superset/discussions/38007#discussioncomment-15820312
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset login form performing a postForm, which submits a hidden form, causing the login button not getting disabled properly [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Superset login form performing a postForm, which submits a hidden form, causing the login button not getting disabled properly
<!-- Answer -->
Good news—no server-side rewrite is needed! Superset already has a JSON-based login endpoint at [`/api/v1/security/login`](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/security/api.py#L104-L197) that accepts a JSON payload like `{"username": "...", "password": "...", "provider": "db"}` and returns a JWT access token instead of performing redirects.
The frontend change would involve switching from `SupersetClient.postForm('/login/', ...)` to a regular `fetch` or `SupersetClient.post` call to `/api/v1/security/login`. This would keep everything within the SPA, allowing the loading state to work properly.
The main consideration is handling the JWT token flow properly—storing the token and using it for subsequent requests—versus the current session-cookie-based approach that the form submission provides.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/25f71635-2b73-4c9f-9f5f-837585852a1b?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/25f71635-2b73-4c9f-9f5f-837585852a1b?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/25f71635-2b73-4c9f-9f5f-837585852a1b?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/25f71635-2b73-4c9f-9f5f-837585852a1b?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/25f71635-2b73-4c9f-9f5f-837585852a1b?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/25f71635-2b73-4c9f-9f5f-837585852a1b?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/25f71635-2b73-4c9f-9f5f-837585852a1b?feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=Good%20news%E2%80%94no%20server-side%20rewrite%20is%20needed%21%20Superset%20already%20has%20a%20JSON-based%20login%20endpoint%20at%20%5B%60/api/v1/security/login%60%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/security/api.py%23L104-L197%29%20that%20accepts%20a%20JSON%20payload%20like%20%60%7B%22username%22%3A%20%22...%22%2C%20%22password%22%3A%20%22...%22%2C%20%22provider%22%3A%20%22db%22%7D%60%20and%20returns%20a%20JWT%20access%20token%20instead%20of%20performing%20redirects.%0A%0AThe%20frontend%20change%20would%20involve%20switching%20from%20%60SupersetClient.postForm%28%27/login/%27%2C%20...%29%60%20to%20a%20regular%20%60fetch%60%20or%20%60SupersetClient.post%60%20call%20to%20%60/api/v1/security
/login%60.%20This%20would%20keep%20everything%20within%20the%20SPA%2C%20allowing%20the%20loading%20state%20to%20work%20properly.%0A%0AThe%20main%20consideration%20is%20handling%20the%20JWT%20token%20flow%20properly%E2%80%94storing%20the%20token%20and%20using%20it%20for%20subsequent%20requests%E2%80%94versus%20the%20current%20session-cookie-based%20approach%20that%20the%20form%20submission%20provides.) [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/38007)
GitHub link: https://github.com/apache/superset/discussions/38007#discussioncomment-15820324
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset login form performing a postForm, which submits a hidden form, causing the login button not getting disabled properly [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Superset login form performing a postForm, which submits a hidden form, causing the login button not getting disabled properly
<!-- Answer -->
You've correctly identified the issue. The [`SupersetClient.postForm`](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/packages/superset-ui-core/src/connection/SupersetClientClass.ts#L118-L146) method creates a hidden HTML form, submits it via traditional browser form POST, and then removes it—this causes a full page navigation rather than an AJAX/fetch request.
In the [login component](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/src/pages/Login/index.tsx), the `onFinish` handler sets `loading` to `true` before calling `postForm()` and expects `.finally()` to reset it. However, since successful login navigates away from the page, the component unmounts before `setLoading(false)` can have any meaningful effect. The loading state only provides brief feedback before navigation occurs and helps prevent double-clicks, but it doesn't function as a proper SPA loading indicator.
This is a known architectural limitation of using `postForm` for authentication. A proper fix would involve migrating to a fetch-based login API that returns a response without full page navigation, allowing React to properly manage the loading state throughout the authentication flow.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/2fbebd49-c407-45bf-8af4-55bce4d2aa68?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/2fbebd49-c407-45bf-8af4-55bce4d2aa68?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/2fbebd49-c407-45bf-8af4-55bce4d2aa68?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/2fbebd49-c407-45bf-8af4-55bce4d2aa68?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/2fbebd49-c407-45bf-8af4-55bce4d2aa68?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/2fbebd49-c407-45bf-8af4-55bce4d2aa68?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/2fbebd49-c407-45bf-8af4-55bce4d2aa68?feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=You%27ve%20correctly%20identified%20the%20issue.%20The%20%5B%60SupersetClient.postForm%60%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/packages/superset-ui-core/src/connection/SupersetClientClass.ts%23L118-L146%29%20method%20creates%20a%20hidden%20HTML%20form%2C%20submits%20it%20via%20traditional%20browser%20form%20POST%2C%20and%20then%20removes%20it%E2%80%94this%20causes%20a%20full%20page%20navigation%20rather%20than%20an%20AJAX/fetch%20request.%0A%0AIn%20the%20%5Blogin%20component%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/src/pages/Login/index.tsx%29%2C%20the%20%60onFinish%60%20handler%20sets%20%60loading%60%20to%20%60true%60%
20before%20calling%20%60postForm%28%29%60%20and%20expects%20%60.finally%28%29%60%20to%20reset%20it.%20However%2C%20since%20successful%20login%20navigates%20away%20from%20the%20page%2C%20the%20component%20unmounts%20before%20%60setLoading%28false%29%60%20can%20have%20any%20meaningful%20effect.%20The%20loading%20state%20only%20provides%20brief%20feedback%20before%20navigation%20occurs%20and%20helps%20prevent%20double-clicks%2C%20but%20it%20doesn%27t%20function%20as%20a%20proper%20SPA%20loading%20indicator.%0A%0AThis%20is%20a%20known%20architectural%20limitation%20of%20using%20%60postForm%60%20for%20authentication.%20A%20proper%20fix%20would%20involve%20migrating%20to%20a%20fetch-based%20login%20API%20that%20returns%20a%20response%20without%20full%20page%20navigation%2C%20allowing%20React%20to%20properly%20manage%20the%20loading%20state%20throughout%20the%20authentication%20flow.) [](https
://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/38007)
GitHub link: https://github.com/apache/superset/discussions/38007#discussioncomment-15820307
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset login form performing a postForm, which submits a hidden form, causing the login button not getting disabled properly [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Superset login form performing a postForm, which submits a hidden form, causing the login button not getting disabled properly
<!-- Answer -->
You've correctly identified the issue. The [`SupersetClient.postForm`](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/packages/superset-ui-core/src/connection/SupersetClientClass.ts#L118-L146) method creates a hidden HTML form, submits it via traditional browser form POST, and then removes it—this causes a full page navigation rather than an AJAX/fetch request.
In the [login component](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/src/pages/Login/index.tsx), the `onFinish` handler sets `loading` to `true` before calling `postForm()` and expects `.finally()` to reset it. However, since successful login navigates away from the page, the component unmounts before `setLoading(false)` can have any meaningful effect. The loading state only provides brief feedback before navigation occurs and helps prevent double-clicks, but it doesn't function as a proper SPA loading indicator.
This is a known architectural limitation of using `postForm` for authentication. A proper fix would involve migrating to a fetch-based login API that returns a response without full page navigation, allowing React to properly manage the loading state throughout the authentication flow.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=2fbebd49-c407-45bf-8af4-55bce4d2aa68) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/38007#discussioncomment-15820307
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset login form performing a postForm, which submits a hidden form, causing the login button not getting disabled properly [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Superset login form performing a postForm, which submits a hidden form, causing the login button not getting disabled properly
<!-- Answer -->
You've reached the anonymous usage limit of `10` interactions per month. Your usage will reset on `2026-03-01`. If you'd like to use Dosu before then, please [register](https://app.dosu.dev/login?referrer=from-anonymous-rate-limit) to increase your limit to `100` interactions per month for free.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/226321ca-3b27-422e-9ddb-5dcb39a32ccf?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/226321ca-3b27-422e-9ddb-5dcb39a32ccf?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/226321ca-3b27-422e-9ddb-5dcb39a32ccf?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/226321ca-3b27-422e-9ddb-5dcb39a32ccf?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/226321ca-3b27-422e-9ddb-5dcb39a32ccf?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/226321ca-3b27-422e-9ddb-5dcb39a32ccf?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/226321ca-3b27-422e-9ddb-5dcb39a32ccf?feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=You%27ve%20reached%20the%20anonymous%20usage%20limit%20of%20%6010%60%20interactions%20per%20month.%20Your%20usage%20will%20reset%20on%20%602026-03-01%60.%20If%20you%27d%20like%20to%20use%20Dosu%20before%20then%2C%20please%20%5Bregister%5D%28https%3A//app.dosu.dev/login%3Freferrer%3Dfrom-anonymous-rate-limit%29%20to%20increase%20your%20limit%20to%20%60100%60%20interactions%20per%20month%20for%20free.) [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/38007)
GitHub link: https://github.com/apache/superset/discussions/38007#discussioncomment-15820417
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset login form performing a postForm, which submits a hidden form, causing the login button not getting disabled properly [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Superset login form performing a postForm, which submits a hidden form, causing the login button not getting disabled properly
<!-- Answer -->
You've reached the anonymous usage limit of `10` interactions per month. Your usage will reset on `2026-03-01`. If you'd like to use Dosu before then, please [register](https://app.dosu.dev/login?referrer=from-anonymous-rate-limit) to increase your limit to `100` interactions per month for free.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=226321ca-3b27-422e-9ddb-5dcb39a32ccf) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/38007#discussioncomment-15820417
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset login form performing a postForm, which submits a hidden form, causing the login button not getting disabled properly [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Superset login form performing a postForm, which submits a hidden form, causing the login button not getting disabled properly
<!-- Answer -->
Good news—no server-side rewrite is needed! Superset already has a JSON-based login endpoint at [`/api/v1/security/login`](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/security/api.py#L104-L197) that accepts a JSON payload like `{"username": "...", "password": "...", "provider": "db"}` and returns a JWT access token instead of performing redirects.
The frontend change would involve switching from `SupersetClient.postForm('/login/', ...)` to a regular `fetch` or `SupersetClient.post` call to `/api/v1/security/login`. This would keep everything within the SPA, allowing the loading state to work properly.
The main consideration is handling the JWT token flow properly—storing the token and using it for subsequent requests—versus the current session-cookie-based approach that the form submission provides.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=25f71635-2b73-4c9f-9f5f-837585852a1b) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/38007#discussioncomment-15820324
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset login form performing a postForm, which submits a hidden form, causing the login button not getting disabled properly [superset]
Posted by "Dev10-34 (via GitHub)" <gi...@apache.org>.
GitHub user Dev10-34 added a comment to the discussion: Superset login form performing a postForm, which submits a hidden form, causing the login button not getting disabled properly
@dosu, the current behavior of the login page leverages the different auth views defined by fab. However, now, react handles the get call, but the post calls still hit the functions defined in the "view" classes themselves. Secondly, the api you mentioned is meant only for superset db an ldap db types. I am not sure if it will support oauth either. So more frontend re write and now it will be case by case basis?
GitHub link: https://github.com/apache/superset/discussions/38007#discussioncomment-15820415
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org