You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "Tranqu1lo (via GitHub)" <gi...@apache.org> on 2026/04/08 14:53:27 UTC
[D] Dasboard embedded [superset]
GitHub user Tranqu1lo created a discussion: Dasboard embedded
Estou usando a versão mais recente do Superset e consigo gerar o guest_token via API usando um usuário autenticado, mas ao tentar acessar um dashboard embutido via /embedded/<uuid> recebo o erro CSRF token is missing.
Detalhes:
Endpoint /api/v1/security/guest_token/ funciona e retorna o token corretamente.
WTF_CSRF_ENABLED = True.
Estou usando HTTP, não HTTPS.
Cookies de sessão estão sendo enviados pelo PHP backend, mas aparentemente não correspondem ao CSRF esperado
GitHub link: https://github.com/apache/superset/discussions/39200
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Dasboard embedded [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Dasboard embedded
<!-- Answer -->
Obrigado pelos logs — eles são úteis. A mensagem chave é `Refresh CSRF token error`, que vem do error handler global para `CSRFError` no Superset [[1]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/views/error_handling.py). Isso significa que uma requisição (provavelmente feita pelo frontend do dashboard embutido) está a ser interceptada pela validação CSRF do Flask-WTF **antes** de chegar ao handler da view.
O que está a acontecer é um ciclo problemático: o dashboard embutido tenta buscar um CSRF token via `/api/v1/security/csrf_token/`, mas essa própria requisição falha com CSRF error, porque os **cookies de sessão não estão a ser entregues ao Superset** pelo browser.
Isso geralmente acontece por causa da configuração de cookies. Pode partilhar a sua configuração atual de `SESSION_COOKIE_SAMESITE`, `SESSION_COOKIE_SECURE`, e se está a usar HTTP ou HTTPS?
Se está a usar **HTTP** (como parecia na discussão anterior), a causa mais provável é:
- `SESSION_COOKIE_SAMESITE = "None"` requer `SESSION_COOKIE_SECURE = True`, que por sua vez requer **HTTPS**
- Sem HTTPS, os browsers modernos simplesmente **não enviam os cookies** em contexto cross-origin (iframe), o que faz com que o CSRF token da sessão nunca chegue ao Superset
As opções para resolver isto são:
1. **Usar HTTPS** tanto no Superset como no site que faz o embedding (solução recomendada)
2. **Se estiver em desenvolvimento local**, pode temporariamente desabilitar CSRF:
```python
WTF_CSRF_ENABLED = False
```
3. Se os domínios forem os mesmos (same-origin), pode usar `SESSION_COOKIE_SAMESITE = "Lax"` em vez de `"None"`, o que funciona sem HTTPS
Também confirme que tem estas configurações no `superset_config.py`:
```python
FEATURE_FLAGS = {"EMBEDDED_SUPERSET": True}
ENABLE_CORS = True
CORS_OPTIONS = {
"origins": ["https://seu-dominio.com"],
"supports_credentials": True
}
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
"content_security_policy": {
"frame-ancestors": ["'self'", "https://seu-dominio.com"]
}
}
```
[[2]](https://github.com/apache/superset/discussions/38444)
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=36be0022-6e5f-43c0-990d-1270edbb7219) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/39200#discussioncomment-16555342
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Dasboard embedded [superset]
Posted by "Tranqu1lo (via GitHub)" <gi...@apache.org>.
GitHub user Tranqu1lo added a comment to the discussion: Dasboard embedded
USE_HTTPS = True
devolve um checklist com tudo o que é necessario para funcionar , o sitema chega a devolver o guest_token.
GitHub link: https://github.com/apache/superset/discussions/39200#discussioncomment-16555605
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Dasboard embedded [superset]
Posted by "Tranqu1lo (via GitHub)" <gi...@apache.org>.
GitHub user Tranqu1lo added a comment to the discussion: Dasboard embedded
Apr 14 11:03:50 viz-tur bash[2812861]: flask_wtf.csrf.CSRFError: 400 Bad Request: The CSRF token is missing.
Apr 14 11:04:29 viz-tur bash[2812858]: 2026-04-14 11:04:29,722:INFO:flask_wtf.csrf:The CSRF token is missing.
Apr 14 11:04:29 viz-tur bash[2812858]: 2026-04-14 11:04:29,722:WARNING:superset.views.error_handling:Refresh CSRF token error
Apr 14 11:04:29 viz-tur bash[2812858]: Traceback (most recent call last):
Apr 14 11:04:29 viz-tur bash[2812858]: File "/app/venv/lib/python3.11/site-packages/flask_wtf/csrf.py", line 261, in protect
Apr 14 11:04:29 viz-tur bash[2812858]: validate_csrf(self._get_csrf_token())
Apr 14 11:04:29 viz-tur bash[2812858]: File "/app/venv/lib/python3.11/site-packages/flask_wtf/csrf.py", line 100, in validate_csrf
Apr 14 11:04:29 viz-tur bash[2812858]: raise ValidationError("The CSRF token is missing.")
Apr 14 11:04:29 viz-tur bash[2812858]: wtforms.validators.ValidationError: The CSRF token is missing.
Apr 14 11:04:29 viz-tur bash[2812858]: During handling of the above exception, another exception occurred:
Apr 14 11:04:29 viz-tur bash[2812858]: Traceback (most recent call last):
Apr 14 11:04:29 viz-tur bash[2812858]: File "/app/venv/lib/python3.11/site-packages/flask/app.py", line 1482, in full_dispatch_request
Apr 14 11:04:29 viz-tur bash[2812858]: rv = self.preprocess_request()
Apr 14 11:04:29 viz-tur bash[2812858]: ^^^^^^^^^^^^^^^^^^^^^^^^^
Apr 14 11:04:29 viz-tur bash[2812858]: File "/app/venv/lib/python3.11/site-packages/flask/app.py", line 1974, in preprocess_request
Apr 14 11:04:29 viz-tur bash[2812858]: rv = self.ensure_sync(before_func)()
Apr 14 11:04:29 viz-tur bash[2812858]: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Apr 14 11:04:29 viz-tur bash[2812858]: File "/app/venv/lib/python3.11/site-packages/flask_wtf/csrf.py", line 229, in csrf_protect
Apr 14 11:04:29 viz-tur bash[2812858]: self.protect()
Apr 14 11:04:29 viz-tur bash[2812858]: File "/app/venv/lib/python3.11/site-packages/flask_wtf/csrf.py", line 264, in protect
Apr 14 11:04:29 viz-tur bash[2812858]: self._error_response(e.args[0])
Apr 14 11:04:29 viz-tur bash[2812858]: File "/app/venv/lib/python3.11/site-packages/flask_wtf/csrf.py", line 307, in _error_response
Apr 14 11:04:29 viz-tur bash[2812858]: raise CSRFError(reason)
GitHub link: https://github.com/apache/superset/discussions/39200#discussioncomment-16555300
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Dasboard embedded [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Dasboard embedded
<!-- Answer -->
Esse erro de CSRF é bastante comum ao configurar dashboards embutidos. O endpoint `/api/v1/security/guest_token/` **não** está na lista padrão de isenção de CSRF do Superset [[1]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py), então mesmo que o token seja gerado corretamente, as requisições subsequentes ao dashboard embutido podem falhar se os cookies de sessão e o CSRF token não estiverem sincronizados.
Aqui estão as configurações que provavelmente faltam no seu `superset_config.py`:
**1. Isentar o endpoint de CSRF (mais simples para desenvolvimento):**
```python
WTF_CSRF_EXEMPT_LIST = ["/api/v1/security/guest_token"]
```
[[2]](https://github.com/apache/superset/discussions/38444)
**2. Configurar cookies de sessão para cross-origin (obrigatório para embedding):**
```python
SESSION_COOKIE_SAMESITE = "None"
SESSION_COOKIE_SECURE = False # False para HTTP, True para HTTPS
SESSION_COOKIE_HTTPONLY = False
```
⚠️ **Nota importante**: Navegadores modernos bloqueiam cookies com `SameSite=None` quando `Secure=False` (HTTP). Isso pode ser a causa raiz do seu problema. Idealmente, use HTTPS mesmo em desenvolvimento [[3]](https://github.com/apache/superset/discussions/38444).
**3. Configurar CORS (se o PHP backend e o Superset estão em domínios/portas diferentes):**
```python
ENABLE_CORS = True
CORS_OPTIONS = {
"origins": ["http://seu-dominio-php.com"],
"supports_credentials": True
}
```
**4. Configurar Content Security Policy para permitir o iframe:**
```python
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
"content_security_policy": {
"frame-ancestors": ["'self'", "http://seu-dominio-php.com"]
}
}
```
[[4]](https://github.com/apache/superset/discussions/38444)
**5. Garantir que o feature flag está habilitado:**
```python
FEATURE_FLAGS = {
"EMBEDDED_SUPERSET": True,
}
```
Se o seu PHP backend está fazendo chamadas server-to-server para obter o `guest_token`, certifique-se de que está buscando o CSRF token primeiro via `/api/v1/security/csrf_token/` e incluindo-o no header `X-CSRFToken` junto com o cookie de sessão nas requisições POST [[5]](https://github.com/apache/superset/discussions/38444). Um erro comum é não repassar corretamente o cookie de sessão entre as chamadas [[6]](https://github.com/apache/superset/discussions/34738).
Como você está usando HTTP, o maior obstáculo vai ser que browsers modernos rejeitam `SameSite=None` sem `Secure=True`. Se possível, migre para HTTPS — mesmo com um certificado auto-assinado em desenvolvimento isso vai resolver a maioria dos problemas de cookies.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=brand-link).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-great_response#message_id=e134e8e0-b079-494e-8bb3-15459b972e9a&feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-irrelevant_answer#message_id=e134e8e0-b079-494e-8bb3-15459b972e9a&feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-incorrect_sources#message_id=e134e8e0-b079-494e-8bb3-15459b972e9a&feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-too_verbose#message_id=e134e8e0-b079-494e-8bb3-15459b972e9a&feedback_type=too_verbose) | [Hallucination](https://app
.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-hallucination#message_id=e134e8e0-b079-494e-8bb3-15459b972e9a&feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-bug_report#message_id=e134e8e0-b079-494e-8bb3-15459b972e9a&feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-other#message_id=e134e8e0-b079-494e-8bb3-15459b972e9a&feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=chat-badge) [](https://cursor.com/link/prompt?text=Esse%20erro%20de%20CSRF%20%C3%A9%20bastante%20comum%20ao%20configurar%20dashboards%20embutidos.%20O%20endpoint%20%60/api/v1/security/guest_token/%60%20%2A%2An%C3%A3o%2A%2A%20est%C3%A1%20na%20lista%20padr%C3%A3o%20de%20isen%C3%A7%C3%A3o%20de%20CSRF%20do%20Superset%20%5B%5B1%5D%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py%29%2C%20ent%C3%A3o%20mesmo%20que%20o%20token%20seja%20gerado%20corretamente%2C%20as%20requisi%C3%A7%C3%B5es%20subsequentes%20ao%20dashboard%20embutido%20podem%20falhar%20se%20os%20cookies%20de%20sess%C3%A3o%20e%20o%20CSRF%20token%20n%C3%A3o%20estiverem%20sincronizados.%0A%0AAqui%20est%C3%A3o%20as%20c
onfigura%C3%A7%C3%B5es%20que%20provavelmente%20faltam%20no%20seu%20%60superset_config.py%60%3A%0A%0A%2A%2A1.%20Isentar%20o%20endpoint%20de%20CSRF%20%28mais%20simples%20para%20desenvolvimento%29%3A%2A%2A%0A%0A%60%60%60python%0AWTF_CSRF_EXEMPT_LIST%20%3D%20%5B%22/api/v1/security/guest_token%22%5D%0A%60%60%60%0A%0A%5B%5B2%5D%5D%28https%3A//github.com/apache/superset/discussions/38444%29%0A%0A%2A%2A2.%20Configurar%20cookies%20de%20sess%C3%A3o%20para%20cross-origin%20%28obrigat%C3%B3rio%20para%20embedding%29%3A%2A%2A%0A%0A%60%60%60python%0ASESSION_COOKIE_SAMESITE%20%3D%20%22None%22%0ASESSION_COOKIE_SECURE%20%3D%20False%20%20%20%23%20False%20para%20HTTP%2C%20True%20para%20HTTPS%0ASESSION_COOKIE_HTTPONLY%20%3D%20False%0A%60%60%60%0A%0A%E2%9A%A0%EF%B8%8F%20%2A%2ANota%20importante%2A%2A%3A%20Navegadores%20modernos%20bloqueiam%20cookies%20com%20%60SameSite%3DNone%60%20quando%20%60Secure%3DFalse%60%20%28HTTP%29.%20Isso%20pode%20ser%20a%20causa%20raiz%20do%20seu%20problema.%20Idealmente%2C%20us
e%20HTTPS%20mesmo%20em%20desenvolvimento%20%5B%5B3%5D%5D%28https%3A//github.com/apache/superset/discussions/38444%29.%0A%0A%2A%2A3.%20Configurar%20CORS%20%28se%20o%20PHP%20backend%20e%20o%20Superset%20est%C3%A3o%20em%20dom%C3%ADnios/portas%20diferentes%29%3A%2A%2A%0A%0A%60%60%60python%0AENABLE_CORS%20%3D%20True%0ACORS_OPTIONS%20%3D%20%7B%0A%20%20%20%20%22origins%22%3A%20%5B%22http%3A//seu-dominio-php.com%22%5D%2C%0A%20%20%20%20%22supports_credentials%22%3A%20True%0A%7D%0A%60%60%60%0A%0A%2A%2A4.%20Configurar%20Content%20Security%20Policy%20para%20permitir%20o%20iframe%3A%2A%2A%0A%0A%60%60%60python%0ATALISMAN_ENABLED%20%3D%20True%0ATALISMAN_CONFIG%20%3D%20%7B%0A%20%20%20%20%22content_security_policy%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%22frame-ancestors%22%3A%20%5B%22%27self%27%22%2C%20%22http%3A//seu-dominio-php.com%22%5D%0A%20%20%20%20%7D%0A%7D%0A%60%60%60%0A%0A%5B%5B4%5D%5D%28https%3A//github.com/apache/superset/discussions/38444%29%0A%0A%2A%2A5.%20Garantir%20que%20o%20feature%20
flag%20est%C3%A1%20habilitado%3A%2A%2A%0A%0A%60%60%60python%0AFEATURE_FLAGS%20%3D%20%7B%0A%20%20%20%20%22EMBEDDED_SUPERSET%22%3A%20True%2C%0A%7D%0A%60%60%60%0A%0ASe%20o%20seu%20PHP%20backend%20est%C3%A1%20fazendo%20chamadas%20server-to-server%20para%20obter%20o%20%60guest_token%60%2C%20certifique-se%20de%20que%20est%C3%A1%20buscando%20o%20CSRF%20token%20primeiro%20via%20%60/api/v1/security/csrf_token/%60%20e%20incluindo-o%20no%20header%20%60X-CSRFToken%60%20junto%20com%20o%20cookie%20de%20sess%C3%A3o%20nas%20requisi%C3%A7%C3%B5es%20POST%20%5B%5B5%5D%5D%28https%3A//github.com/apache/superset/discussions/38444%29.%20Um%20erro%20comum%20%C3%A9%20n%C3%A3o%20repassar%20corretamente%20o%20cookie%20de%20sess%C3%A3o%20entre%20as%20chamadas%20%5B%5B6%5D%5D%28https%3A//github.com/apache/superset/discussions/34738%29.%0A%0AComo%20voc%C3%AA%20est%C3%A1%20usando%20HTTP%2C%20o%20maior%20obst%C3%A1culo%20vai%20ser%20que%20browsers%20modernos%20rejeitam%20%60SameSite%3DNone%60%20sem%20%60Secure%3DT
rue%60.%20Se%20poss%C3%ADvel%2C%20migre%20para%20HTTPS%20%E2%80%94%20mesmo%20com%20um%20certificado%20auto-assinado%20em%20desenvolvimento%20isso%20vai%20resolver%20a%20maioria%20dos%20problemas%20de%20cookies.) [](https://go.dosu.dev/discord-bot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=join-discord) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/39200)
GitHub link: https://github.com/apache/superset/discussions/39200#discussioncomment-16490798
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Dasboard embedded [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Dasboard embedded
<!-- Answer -->
**Ambos precisam de HTTPS (certificado SSL) em produção.** O motivo é que para dashboards embutidos funcionarem cross-origin, você precisa de `SESSION_COOKIE_SAMESITE = "None"`, e navegadores modernos **exigem** que `SESSION_COOKIE_SECURE = True` (ou seja, HTTPS) quando `SameSite=None` está configurado [[1]](https://github.com/apache/superset/discussions/38444). Isso se aplica tanto ao Superset quanto ao site que faz o embedding.
Resumindo:
- ✅ **HTTP nos dois** — funciona apenas para desenvolvimento local
- ✅ **HTTPS nos dois** — recomendado para produção
- ❌ **Misturar HTTP e HTTPS** — não funciona, navegadores bloqueiam os cookies
Quanto a erros que podem acontecer mesmo com HTTPS configurado no Superset:
1. **CSRF token missing** — Mesmo com HTTPS, se você não buscar o CSRF token via `/api/v1/security/csrf_token/` e incluí-lo no header `X-CSRFToken` das requisições POST, vai continuar recebendo o erro de CSRF [[2]](https://github.com/apache/superset/discussions/38444#discussioncomment-16042778).
2. **CSP (Content Security Policy) bloqueando o iframe** — Você precisa configurar o Talisman para permitir que seu site carregue o Superset em iframe:
```python
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
"content_security_policy": {
"frame-ancestors": ["'self'", "https://seu-site.com"]
}
}
```
3. **CORS não configurado** — Se os domínios são diferentes, configure:
```python
ENABLE_CORS = True
CORS_OPTIONS = {
"origins": ["https://seu-site.com"],
"supports_credentials": True
}
```
4. **Proxy reverso sem ENABLE_PROXY_FIX** — Se você estiver usando um load balancer ou proxy reverso (como Nginx) para terminar o SSL, habilite `ENABLE_PROXY_FIX = True` no `superset_config.py` para que o Superset reconheça corretamente os headers `X-Forwarded-Proto` e saiba que está rodando em HTTPS [[3]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/docs/docs/configuration/configuring-superset.mdx).
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=brand-link).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-great_response#message_id=8472ee05-640e-4823-8062-b49e6bc00b47&feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-irrelevant_answer#message_id=8472ee05-640e-4823-8062-b49e6bc00b47&feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-incorrect_sources#message_id=8472ee05-640e-4823-8062-b49e6bc00b47&feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-too_verbose#message_id=8472ee05-640e-4823-8062-b49e6bc00b47&feedback_type=too_verbose) | [Hallucination](https://app
.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-hallucination#message_id=8472ee05-640e-4823-8062-b49e6bc00b47&feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-bug_report#message_id=8472ee05-640e-4823-8062-b49e6bc00b47&feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-other#message_id=8472ee05-640e-4823-8062-b49e6bc00b47&feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=chat-badge) [](https://cursor.com/link/prompt?text=%2A%2AAmbos%20precisam%20de%20HTTPS%20%28certificado%20SSL%29%20em%20produ%C3%A7%C3%A3o.%2A%2A%20O%20motivo%20%C3%A9%20que%20para%20dashboards%20embutidos%20funcionarem%20cross-origin%2C%20voc%C3%AA%20precisa%20de%20%60SESSION_COOKIE_SAMESITE%20%3D%20%22None%22%60%2C%20e%20navegadores%20modernos%20%2A%2Aexigem%2A%2A%20que%20%60SESSION_COOKIE_SECURE%20%3D%20True%60%20%28ou%20seja%2C%20HTTPS%29%20quando%20%60SameSite%3DNone%60%20est%C3%A1%20configurado%20%5B%5B1%5D%5D%28https%3A//github.com/apache/superset/discussions/38444%29.%20Isso%20se%20aplica%20tanto%20ao%20Superset%20quanto%20ao%20site%20que%20faz%20o%20embedding.%0A%0AResumindo%3A%0A%0A-%20%E2%9C%85%20%2A%2AHTTP%20nos%20
dois%2A%2A%20%E2%80%94%20funciona%20apenas%20para%20desenvolvimento%20local%0A-%20%E2%9C%85%20%2A%2AHTTPS%20nos%20dois%2A%2A%20%E2%80%94%20recomendado%20para%20produ%C3%A7%C3%A3o%0A-%20%E2%9D%8C%20%2A%2AMisturar%20HTTP%20e%20HTTPS%2A%2A%20%E2%80%94%20n%C3%A3o%20funciona%2C%20navegadores%20bloqueiam%20os%20cookies%0A%0AQuanto%20a%20erros%20que%20podem%20acontecer%20mesmo%20com%20HTTPS%20configurado%20no%20Superset%3A%0A%0A1.%20%2A%2ACSRF%20token%20missing%2A%2A%20%E2%80%94%20Mesmo%20com%20HTTPS%2C%20se%20voc%C3%AA%20n%C3%A3o%20buscar%20o%20CSRF%20token%20via%20%60/api/v1/security/csrf_token/%60%20e%20inclu%C3%AD-lo%20no%20header%20%60X-CSRFToken%60%20das%20requisi%C3%A7%C3%B5es%20POST%2C%20vai%20continuar%20recebendo%20o%20erro%20de%20CSRF%20%5B%5B2%5D%5D%28https%3A//github.com/apache/superset/discussions/38444%23discussioncomment-16042778%29.%0A%0A2.%20%2A%2ACSP%20%28Content%20Security%20Policy%29%20bloqueando%20o%20iframe%2A%2A%20%E2%80%94%20Voc%C3%AA%20precisa%20configurar%20o%20T
alisman%20para%20permitir%20que%20seu%20site%20carregue%20o%20Superset%20em%20iframe%3A%0A%0A%20%20%20%60%60%60python%0A%20%20%20TALISMAN_ENABLED%20%3D%20True%0A%20%20%20TALISMAN_CONFIG%20%3D%20%7B%0A%20%20%20%20%20%20%20%22content_security_policy%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%22frame-ancestors%22%3A%20%5B%22%27self%27%22%2C%20%22https%3A//seu-site.com%22%5D%0A%20%20%20%20%20%20%20%7D%0A%20%20%20%7D%0A%20%20%20%60%60%60%0A%0A3.%20%2A%2ACORS%20n%C3%A3o%20configurado%2A%2A%20%E2%80%94%20Se%20os%20dom%C3%ADnios%20s%C3%A3o%20diferentes%2C%20configure%3A%0A%0A%20%20%20%60%60%60python%0A%20%20%20ENABLE_CORS%20%3D%20True%0A%20%20%20CORS_OPTIONS%20%3D%20%7B%0A%20%20%20%20%20%20%20%22origins%22%3A%20%5B%22https%3A//seu-site.com%22%5D%2C%0A%20%20%20%20%20%20%20%22supports_credentials%22%3A%20True%0A%20%20%20%7D%0A%20%20%20%60%60%60%0A%0A4.%20%2A%2AProxy%20reverso%20sem%20ENABLE_PROXY_FIX%2A%2A%20%E2%80%94%20Se%20voc%C3%AA%20estiver%20usando%20um%20load%20balancer%20ou%20prox
y%20reverso%20%28como%20Nginx%29%20para%20terminar%20o%20SSL%2C%20habilite%20%60ENABLE_PROXY_FIX%20%3D%20True%60%20no%20%60superset_config.py%60%20para%20que%20o%20Superset%20reconhe%C3%A7a%20corretamente%20os%20headers%20%60X-Forwarded-Proto%60%20e%20saiba%20que%20est%C3%A1%20rodando%20em%20HTTPS%20%5B%5B3%5D%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/docs/docs/configuration/configuring-superset.mdx%29.) [](https://go.dosu.dev/discord-bot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=join-discord) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/39200)
GitHub link: https://github.com/apache/superset/discussions/39200#discussioncomment-16500220
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Dasboard embedded [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Dasboard embedded
<!-- Answer -->
Atenção — `USE_HTTPS` **não é uma variável nativa do Superset** [[1]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py). Se não a definiu explicitamente no seu `superset_config.py`, essa linha vai dar `NameError`, ou se estiver definida como `False` por defeito noutro lado, `SESSION_COOKIE_SECURE` ficará como `False` — e os cookies não serão enviados corretamente em contexto cross-origin com `SameSite=None`.
Confirme o valor real substituindo por:
```python
SESSION_COOKIE_SECURE = True
```
Isso é obrigatório quando usa HTTPS com `SESSION_COOKIE_SAMESITE = "None"` — sem `Secure=True`, os browsers bloqueiam os cookies no iframe e o CSRF token da sessão nunca chega ao Superset, o que explica exatamente o erro que está a ver.
Além disso, confirme que tem as configurações de **CORS** e **CSP** a apontar para o domínio do seu site:
```python
ENABLE_CORS = True
CORS_OPTIONS = {
"origins": ["https://seu-site.com"],
"supports_credentials": True
}
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
"content_security_policy": {
"frame-ancestors": ["'self'", "https://seu-site.com"]
}
}
```
Após alterar, reinicie o Superset e verifique se o erro de CSRF desaparece.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=7a5f68c2-7bf1-4361-ade1-9252a4d567f8) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/39200#discussioncomment-16555456
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Dasboard embedded [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Dasboard embedded
<!-- Answer -->
**Ambos precisam de HTTPS (certificado SSL) em produção.** O motivo é que para dashboards embutidos funcionarem cross-origin, você precisa de `SESSION_COOKIE_SAMESITE = "None"`, e navegadores modernos **exigem** que `SESSION_COOKIE_SECURE = True` (ou seja, HTTPS) quando `SameSite=None` está configurado [[1]](https://github.com/apache/superset/discussions/38444). Isso se aplica tanto ao Superset quanto ao site que faz o embedding.
Resumindo:
- ✅ **HTTP nos dois** — funciona apenas para desenvolvimento local
- ✅ **HTTPS nos dois** — recomendado para produção
- ❌ **Misturar HTTP e HTTPS** — não funciona, navegadores bloqueiam os cookies
Quanto a erros que podem acontecer mesmo com HTTPS configurado no Superset:
1. **CSRF token missing** — Mesmo com HTTPS, se você não buscar o CSRF token via `/api/v1/security/csrf_token/` e incluí-lo no header `X-CSRFToken` das requisições POST, vai continuar recebendo o erro de CSRF [[2]](https://github.com/apache/superset/discussions/38444#discussioncomment-16042778).
2. **CSP (Content Security Policy) bloqueando o iframe** — Você precisa configurar o Talisman para permitir que seu site carregue o Superset em iframe:
```python
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
"content_security_policy": {
"frame-ancestors": ["'self'", "https://seu-site.com"]
}
}
```
3. **CORS não configurado** — Se os domínios são diferentes, configure:
```python
ENABLE_CORS = True
CORS_OPTIONS = {
"origins": ["https://seu-site.com"],
"supports_credentials": True
}
```
4. **Proxy reverso sem ENABLE_PROXY_FIX** — Se você estiver usando um load balancer ou proxy reverso (como Nginx) para terminar o SSL, habilite `ENABLE_PROXY_FIX = True` no `superset_config.py` para que o Superset reconheça corretamente os headers `X-Forwarded-Proto` e saiba que está rodando em HTTPS [[3]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/docs/docs/configuration/configuring-superset.mdx).
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=8472ee05-640e-4823-8062-b49e6bc00b47) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/39200#discussioncomment-16500220
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Dasboard embedded [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Dasboard embedded
<!-- Answer -->
O seu caso é interessante porque o guest token é gerado com sucesso, mas o erro de CSRF acontece **durante o carregamento do dashboard**. Isso significa que o problema não está na geração do token, mas sim nas chamadas API que o dashboard faz ao renderizar.
O dashboard embutido faz várias chamadas API além do guest token — por exemplo, `/api/v1/me/roles/`, `/api/v1/embedded_dashboard/<uuid>`, entre outras [[1]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/views/users/api.py). A `WTF_CSRF_EXEMPT_LIST` com apenas o endpoint do guest token não cobre essas chamadas.
Há duas coisas a verificar:
**1. Configuração de cookies de sessão** — Esta é provavelmente a causa raiz. Para embedding cross-origin, os cookies precisam ser configurados assim no `superset_config.py`:
```python
SESSION_COOKIE_SAMESITE = "None"
SESSION_COOKIE_SECURE = True # Requer HTTPS
SESSION_COOKIE_HTTPONLY = True
```
Se estiver a usar HTTP, os browsers modernos vão bloquear cookies `SameSite=None` sem `Secure=True`, o que faz com que o CSRF token da sessão nunca chegue ao Superset [[2]](https://github.com/apache/superset/discussions/38444).
**2. CORS e CSP** — Se o seu site e o Superset estão em domínios diferentes:
```python
ENABLE_CORS = True
CORS_OPTIONS = {
"origins": ["https://seu-dominio.com"],
"supports_credentials": True
}
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
"content_security_policy": {
"frame-ancestors": ["'self'", "https://seu-dominio.com"]
}
}
```
[[3]](https://github.com/apache/superset/discussions/38444)
**3. Como diagnóstico**, verifique nos logs qual endpoint exato está a falhar — o erro de CSRF deve indicar qual API call está a ser rejeitada. Isso ajuda a saber se precisa de adicionar mais endpoints à `WTF_CSRF_EXEMPT_LIST`.
**4. Permissões do Public role** — Uma fix recente [[4]](https://github.com/apache/superset/pull/38474) mostrou que a falta de permissões de `CurrentUserRestApi` no Public role pode causar falhas em dashboards embutidos. Verifique se o role tem as permissões corretas.
Pode partilhar qual é o endpoint exato que aparece nos logs com o erro de CSRF? Isso ajudaria a identificar a solução mais precisa.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=1ec6f1e4-3a2b-42da-9ac3-627038d535b9) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/39200#discussioncomment-16554697
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Dasboard embedded [superset]
Posted by "Tranqu1lo (via GitHub)" <gi...@apache.org>.
GitHub user Tranqu1lo added a comment to the discussion: Dasboard embedded
Estou a usar dashboards embebidos no Apache Superset com guest token e estou a ter um problema de CSRF.
🔧 Configuração
Superset com Embedded dashboards ativado
Uso de guest token API (/api/v1/security/guest_token)
Token é gerado com sucesso
Já tentei WTF_CSRF_EXEMPT_LIST
❌ Problema
Durante o carregamento do dashboard recebo nos logs:
flask_wtf.csrf.CSRFError: 400 Bad Request: The CSRF token is missing
GitHub link: https://github.com/apache/superset/discussions/39200#discussioncomment-16554639
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Dasboard embedded [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Dasboard embedded
<!-- Answer -->
O seu caso é interessante porque o guest token é gerado com sucesso, mas o erro de CSRF acontece **durante o carregamento do dashboard**. Isso significa que o problema não está na geração do token, mas sim nas chamadas API que o dashboard faz ao renderizar.
O dashboard embutido faz várias chamadas API além do guest token — por exemplo, `/api/v1/me/roles/`, `/api/v1/embedded_dashboard/<uuid>`, entre outras [[1]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/views/users/api.py). A `WTF_CSRF_EXEMPT_LIST` com apenas o endpoint do guest token não cobre essas chamadas.
Há duas coisas a verificar:
**1. Configuração de cookies de sessão** — Esta é provavelmente a causa raiz. Para embedding cross-origin, os cookies precisam ser configurados assim no `superset_config.py`:
```python
SESSION_COOKIE_SAMESITE = "None"
SESSION_COOKIE_SECURE = True # Requer HTTPS
SESSION_COOKIE_HTTPONLY = True
```
Se estiver a usar HTTP, os browsers modernos vão bloquear cookies `SameSite=None` sem `Secure=True`, o que faz com que o CSRF token da sessão nunca chegue ao Superset [[2]](https://github.com/apache/superset/discussions/38444).
**2. CORS e CSP** — Se o seu site e o Superset estão em domínios diferentes:
```python
ENABLE_CORS = True
CORS_OPTIONS = {
"origins": ["https://seu-dominio.com"],
"supports_credentials": True
}
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
"content_security_policy": {
"frame-ancestors": ["'self'", "https://seu-dominio.com"]
}
}
```
[[3]](https://github.com/apache/superset/discussions/38444)
**3. Como diagnóstico**, verifique nos logs qual endpoint exato está a falhar — o erro de CSRF deve indicar qual API call está a ser rejeitada. Isso ajuda a saber se precisa de adicionar mais endpoints à `WTF_CSRF_EXEMPT_LIST`.
**4. Permissões do Public role** — Uma fix recente [[4]](https://github.com/apache/superset/pull/38474) mostrou que a falta de permissões de `CurrentUserRestApi` no Public role pode causar falhas em dashboards embutidos. Verifique se o role tem as permissões corretas.
Pode partilhar qual é o endpoint exato que aparece nos logs com o erro de CSRF? Isso ajudaria a identificar a solução mais precisa.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=brand-link).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-great_response#message_id=1ec6f1e4-3a2b-42da-9ac3-627038d535b9&feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-irrelevant_answer#message_id=1ec6f1e4-3a2b-42da-9ac3-627038d535b9&feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-incorrect_sources#message_id=1ec6f1e4-3a2b-42da-9ac3-627038d535b9&feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-too_verbose#message_id=1ec6f1e4-3a2b-42da-9ac3-627038d535b9&feedback_type=too_verbose) | [Hallucination](https://app
.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-hallucination#message_id=1ec6f1e4-3a2b-42da-9ac3-627038d535b9&feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-bug_report#message_id=1ec6f1e4-3a2b-42da-9ac3-627038d535b9&feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-other#message_id=1ec6f1e4-3a2b-42da-9ac3-627038d535b9&feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=chat-badge) [](https://cursor.com/link/prompt?text=O%20seu%20caso%20%C3%A9%20interessante%20porque%20o%20guest%20token%20%C3%A9%20gerado%20com%20sucesso%2C%20mas%20o%20erro%20de%20CSRF%20acontece%20%2A%2Adurante%20o%20carregamento%20do%20dashboard%2A%2A.%20Isso%20significa%20que%20o%20problema%20n%C3%A3o%20est%C3%A1%20na%20gera%C3%A7%C3%A3o%20do%20token%2C%20mas%20sim%20nas%20chamadas%20API%20que%20o%20dashboard%20faz%20ao%20renderizar.%0A%0AO%20dashboard%20embutido%20faz%20v%C3%A1rias%20chamadas%20API%20al%C3%A9m%20do%20guest%20token%20%E2%80%94%20por%20exemplo%2C%20%60/api/v1/me/roles/%60%2C%20%60/api/v1/embedded_dashboard/%3Cuuid%3E%60%2C%20entre%20outras%20%5B%5B1%5D%5D%28https%3A//github.com/apache/superset/blob/829e4d92d
91ceae4b43b1ed3b063ffe45377799c/superset/views/users/api.py%29.%20A%20%60WTF_CSRF_EXEMPT_LIST%60%20com%20apenas%20o%20endpoint%20do%20guest%20token%20n%C3%A3o%20cobre%20essas%20chamadas.%0A%0AH%C3%A1%20duas%20coisas%20a%20verificar%3A%0A%0A%2A%2A1.%20Configura%C3%A7%C3%A3o%20de%20cookies%20de%20sess%C3%A3o%2A%2A%20%E2%80%94%20Esta%20%C3%A9%20provavelmente%20a%20causa%20raiz.%20Para%20embedding%20cross-origin%2C%20os%20cookies%20precisam%20ser%20configurados%20assim%20no%20%60superset_config.py%60%3A%0A%0A%60%60%60python%0ASESSION_COOKIE_SAMESITE%20%3D%20%22None%22%0ASESSION_COOKIE_SECURE%20%3D%20True%20%20%20%23%20Requer%20HTTPS%0ASESSION_COOKIE_HTTPONLY%20%3D%20True%0A%60%60%60%0A%0ASe%20estiver%20a%20usar%20HTTP%2C%20os%20browsers%20modernos%20v%C3%A3o%20bloquear%20cookies%20%60SameSite%3DNone%60%20sem%20%60Secure%3DTrue%60%2C%20o%20que%20faz%20com%20que%20o%20CSRF%20token%20da%20sess%C3%A3o%20nunca%20chegue%20ao%20Superset%20%5B%5B2%5D%5D%28https%3A//github.com/apache/superset/di
scussions/38444%29.%0A%0A%2A%2A2.%20CORS%20e%20CSP%2A%2A%20%E2%80%94%20Se%20o%20seu%20site%20e%20o%20Superset%20est%C3%A3o%20em%20dom%C3%ADnios%20diferentes%3A%0A%0A%60%60%60python%0AENABLE_CORS%20%3D%20True%0ACORS_OPTIONS%20%3D%20%7B%0A%20%20%20%20%22origins%22%3A%20%5B%22https%3A//seu-dominio.com%22%5D%2C%0A%20%20%20%20%22supports_credentials%22%3A%20True%0A%7D%0A%0ATALISMAN_ENABLED%20%3D%20True%0ATALISMAN_CONFIG%20%3D%20%7B%0A%20%20%20%20%22content_security_policy%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%22frame-ancestors%22%3A%20%5B%22%27self%27%22%2C%20%22https%3A//seu-dominio.com%22%5D%0A%20%20%20%20%7D%0A%7D%0A%60%60%60%0A%0A%5B%5B3%5D%5D%28https%3A//github.com/apache/superset/discussions/38444%29%0A%0A%2A%2A3.%20Como%20diagn%C3%B3stico%2A%2A%2C%20verifique%20nos%20logs%20qual%20endpoint%20exato%20est%C3%A1%20a%20falhar%20%E2%80%94%20o%20erro%20de%20CSRF%20deve%20indicar%20qual%20API%20call%20est%C3%A1%20a%20ser%20rejeitada.%20Isso%20ajuda%20a%20saber%20se%20precisa%20de%20adic
ionar%20mais%20endpoints%20%C3%A0%20%60WTF_CSRF_EXEMPT_LIST%60.%0A%0A%2A%2A4.%20Permiss%C3%B5es%20do%20Public%20role%2A%2A%20%E2%80%94%20Uma%20fix%20recente%20%5B%5B4%5D%5D%28https%3A//github.com/apache/superset/pull/38474%29%20mostrou%20que%20a%20falta%20de%20permiss%C3%B5es%20de%20%60CurrentUserRestApi%60%20no%20Public%20role%20pode%20causar%20falhas%20em%20dashboards%20embutidos.%20Verifique%20se%20o%20role%20tem%20as%20permiss%C3%B5es%20corretas.%0A%0APode%20partilhar%20qual%20%C3%A9%20o%20endpoint%20exato%20que%20aparece%20nos%20logs%20com%20o%20erro%20de%20CSRF%3F%20Isso%20ajudaria%20a%20identificar%20a%20solu%C3%A7%C3%A3o%20mais%20precisa.) [](https://go.dosu.dev/discord-bot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=join-discord) [](https://twitter.com/intent/tweet?text=%40dosu_
ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/39200)
GitHub link: https://github.com/apache/superset/discussions/39200#discussioncomment-16554697
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Dasboard embedded [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Dasboard embedded
<!-- Answer -->
Atenção — `USE_HTTPS` **não é uma variável nativa do Superset** [[1]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py). Se não a definiu explicitamente no seu `superset_config.py`, essa linha vai dar `NameError`, ou se estiver definida como `False` por defeito noutro lado, `SESSION_COOKIE_SECURE` ficará como `False` — e os cookies não serão enviados corretamente em contexto cross-origin com `SameSite=None`.
Confirme o valor real substituindo por:
```python
SESSION_COOKIE_SECURE = True
```
Isso é obrigatório quando usa HTTPS com `SESSION_COOKIE_SAMESITE = "None"` — sem `Secure=True`, os browsers bloqueiam os cookies no iframe e o CSRF token da sessão nunca chega ao Superset, o que explica exatamente o erro que está a ver.
Além disso, confirme que tem as configurações de **CORS** e **CSP** a apontar para o domínio do seu site:
```python
ENABLE_CORS = True
CORS_OPTIONS = {
"origins": ["https://seu-site.com"],
"supports_credentials": True
}
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
"content_security_policy": {
"frame-ancestors": ["'self'", "https://seu-site.com"]
}
}
```
Após alterar, reinicie o Superset e verifique se o erro de CSRF desaparece.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=brand-link).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-great_response#message_id=7a5f68c2-7bf1-4361-ade1-9252a4d567f8&feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-irrelevant_answer#message_id=7a5f68c2-7bf1-4361-ade1-9252a4d567f8&feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-incorrect_sources#message_id=7a5f68c2-7bf1-4361-ade1-9252a4d567f8&feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-too_verbose#message_id=7a5f68c2-7bf1-4361-ade1-9252a4d567f8&feedback_type=too_verbose) | [Hallucination](https://app
.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-hallucination#message_id=7a5f68c2-7bf1-4361-ade1-9252a4d567f8&feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-bug_report#message_id=7a5f68c2-7bf1-4361-ade1-9252a4d567f8&feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-other#message_id=7a5f68c2-7bf1-4361-ade1-9252a4d567f8&feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=chat-badge) [](https://cursor.com/link/prompt?text=Aten%C3%A7%C3%A3o%20%E2%80%94%20%60USE_HTTPS%60%20%2A%2An%C3%A3o%20%C3%A9%20uma%20vari%C3%A1vel%20nativa%20do%20Superset%2A%2A%20%5B%5B1%5D%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py%29.%20Se%20n%C3%A3o%20a%20definiu%20explicitamente%20no%20seu%20%60superset_config.py%60%2C%20essa%20linha%20vai%20dar%20%60NameError%60%2C%20ou%20se%20estiver%20definida%20como%20%60False%60%20por%20defeito%20noutro%20lado%2C%20%60SESSION_COOKIE_SECURE%60%20ficar%C3%A1%20como%20%60False%60%20%E2%80%94%20e%20os%20cookies%20n%C3%A3o%20ser%C3%A3o%20enviados%20corretamente%20em%20contexto%20cross-origin%20com%20%60SameSite%3DNone%60.%0A%
0AConfirme%20o%20valor%20real%20substituindo%20por%3A%0A%0A%60%60%60python%0ASESSION_COOKIE_SECURE%20%3D%20True%0A%60%60%60%0A%0AIsso%20%C3%A9%20obrigat%C3%B3rio%20quando%20usa%20HTTPS%20com%20%60SESSION_COOKIE_SAMESITE%20%3D%20%22None%22%60%20%E2%80%94%20sem%20%60Secure%3DTrue%60%2C%20os%20browsers%20bloqueiam%20os%20cookies%20no%20iframe%20e%20o%20CSRF%20token%20da%20sess%C3%A3o%20nunca%20chega%20ao%20Superset%2C%20o%20que%20explica%20exatamente%20o%20erro%20que%20est%C3%A1%20a%20ver.%0A%0AAl%C3%A9m%20disso%2C%20confirme%20que%20tem%20as%20configura%C3%A7%C3%B5es%20de%20%2A%2ACORS%2A%2A%20e%20%2A%2ACSP%2A%2A%20a%20apontar%20para%20o%20dom%C3%ADnio%20do%20seu%20site%3A%0A%0A%60%60%60python%0AENABLE_CORS%20%3D%20True%0ACORS_OPTIONS%20%3D%20%7B%0A%20%20%20%20%22origins%22%3A%20%5B%22https%3A//seu-site.com%22%5D%2C%0A%20%20%20%20%22supports_credentials%22%3A%20True%0A%7D%0A%0ATALISMAN_ENABLED%20%3D%20True%0ATALISMAN_CONFIG%20%3D%20%7B%0A%20%20%20%20%22content_security_policy%22%3A%20%
7B%0A%20%20%20%20%20%20%20%20%22frame-ancestors%22%3A%20%5B%22%27self%27%22%2C%20%22https%3A//seu-site.com%22%5D%0A%20%20%20%20%7D%0A%7D%0A%60%60%60%0A%0AAp%C3%B3s%20alterar%2C%20reinicie%20o%20Superset%20e%20verifique%20se%20o%20erro%20de%20CSRF%20desaparece.) [](https://go.dosu.dev/discord-bot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=join-discord) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/39200)
GitHub link: https://github.com/apache/superset/discussions/39200#discussioncomment-16555456
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Dasboard embedded [superset]
Posted by "Tranqu1lo (via GitHub)" <gi...@apache.org>.
GitHub user Tranqu1lo added a comment to the discussion: Dasboard embedded
Preciso de ter certificado no meu site ou apenas no superset ? Tendo o certificado de segurança do superset existe algum erro que possa acontecer no superset ?
GitHub link: https://github.com/apache/superset/discussions/39200#discussioncomment-16500185
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Dasboard embedded [superset]
Posted by "Tranqu1lo (via GitHub)" <gi...@apache.org>.
GitHub user Tranqu1lo added a comment to the discussion: Dasboard embedded
SESSION_COOKIE_HTTPONLY = False
SESSION_COOKIE_SAMESITE = "None"
SESSION_COOKIE_SECURE = USE_HTTPS
estou a usar https no site e no superset
GitHub link: https://github.com/apache/superset/discussions/39200#discussioncomment-16555440
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Dasboard embedded [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Dasboard embedded
<!-- Answer -->
Obrigado pelos logs — eles são úteis. A mensagem chave é `Refresh CSRF token error`, que vem do error handler global para `CSRFError` no Superset [[1]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/views/error_handling.py). Isso significa que uma requisição (provavelmente feita pelo frontend do dashboard embutido) está a ser interceptada pela validação CSRF do Flask-WTF **antes** de chegar ao handler da view.
O que está a acontecer é um ciclo problemático: o dashboard embutido tenta buscar um CSRF token via `/api/v1/security/csrf_token/`, mas essa própria requisição falha com CSRF error, porque os **cookies de sessão não estão a ser entregues ao Superset** pelo browser.
Isso geralmente acontece por causa da configuração de cookies. Pode partilhar a sua configuração atual de `SESSION_COOKIE_SAMESITE`, `SESSION_COOKIE_SECURE`, e se está a usar HTTP ou HTTPS?
Se está a usar **HTTP** (como parecia na discussão anterior), a causa mais provável é:
- `SESSION_COOKIE_SAMESITE = "None"` requer `SESSION_COOKIE_SECURE = True`, que por sua vez requer **HTTPS**
- Sem HTTPS, os browsers modernos simplesmente **não enviam os cookies** em contexto cross-origin (iframe), o que faz com que o CSRF token da sessão nunca chegue ao Superset
As opções para resolver isto são:
1. **Usar HTTPS** tanto no Superset como no site que faz o embedding (solução recomendada)
2. **Se estiver em desenvolvimento local**, pode temporariamente desabilitar CSRF:
```python
WTF_CSRF_ENABLED = False
```
3. Se os domínios forem os mesmos (same-origin), pode usar `SESSION_COOKIE_SAMESITE = "Lax"` em vez de `"None"`, o que funciona sem HTTPS
Também confirme que tem estas configurações no `superset_config.py`:
```python
FEATURE_FLAGS = {"EMBEDDED_SUPERSET": True}
ENABLE_CORS = True
CORS_OPTIONS = {
"origins": ["https://seu-dominio.com"],
"supports_credentials": True
}
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
"content_security_policy": {
"frame-ancestors": ["'self'", "https://seu-dominio.com"]
}
}
```
[[2]](https://github.com/apache/superset/discussions/38444)
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=brand-link).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-great_response#message_id=36be0022-6e5f-43c0-990d-1270edbb7219&feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-irrelevant_answer#message_id=36be0022-6e5f-43c0-990d-1270edbb7219&feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-incorrect_sources#message_id=36be0022-6e5f-43c0-990d-1270edbb7219&feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-too_verbose#message_id=36be0022-6e5f-43c0-990d-1270edbb7219&feedback_type=too_verbose) | [Hallucination](https://app
.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-hallucination#message_id=36be0022-6e5f-43c0-990d-1270edbb7219&feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-bug_report#message_id=36be0022-6e5f-43c0-990d-1270edbb7219&feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-other#message_id=36be0022-6e5f-43c0-990d-1270edbb7219&feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=chat-badge) [](https://cursor.com/link/prompt?text=Obrigado%20pelos%20logs%20%E2%80%94%20eles%20s%C3%A3o%20%C3%BAteis.%20A%20mensagem%20chave%20%C3%A9%20%60Refresh%20CSRF%20token%20error%60%2C%20que%20vem%20do%20error%20handler%20global%20para%20%60CSRFError%60%20no%20Superset%20%5B%5B1%5D%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/views/error_handling.py%29.%20Isso%20significa%20que%20uma%20requisi%C3%A7%C3%A3o%20%28provavelmente%20feita%20pelo%20frontend%20do%20dashboard%20embutido%29%20est%C3%A1%20a%20ser%20interceptada%20pela%20valida%C3%A7%C3%A3o%20CSRF%20do%20Flask-WTF%20%2A%2Aantes%2A%2A%20de%20chegar%20ao%20handler%20da%20view.%0A%0AO%20que%20est%C3%A1%20a%20acontec
er%20%C3%A9%20um%20ciclo%20problem%C3%A1tico%3A%20o%20dashboard%20embutido%20tenta%20buscar%20um%20CSRF%20token%20via%20%60/api/v1/security/csrf_token/%60%2C%20mas%20essa%20pr%C3%B3pria%20requisi%C3%A7%C3%A3o%20falha%20com%20CSRF%20error%2C%20porque%20os%20%2A%2Acookies%20de%20sess%C3%A3o%20n%C3%A3o%20est%C3%A3o%20a%20ser%20entregues%20ao%20Superset%2A%2A%20pelo%20browser.%0A%0AIsso%20geralmente%20acontece%20por%20causa%20da%20configura%C3%A7%C3%A3o%20de%20cookies.%20Pode%20partilhar%20a%20sua%20configura%C3%A7%C3%A3o%20atual%20de%20%60SESSION_COOKIE_SAMESITE%60%2C%20%60SESSION_COOKIE_SECURE%60%2C%20e%20se%20est%C3%A1%20a%20usar%20HTTP%20ou%20HTTPS%3F%0A%0ASe%20est%C3%A1%20a%20usar%20%2A%2AHTTP%2A%2A%20%28como%20parecia%20na%20discuss%C3%A3o%20anterior%29%2C%20a%20causa%20mais%20prov%C3%A1vel%20%C3%A9%3A%0A%0A-%20%60SESSION_COOKIE_SAMESITE%20%3D%20%22None%22%60%20requer%20%60SESSION_COOKIE_SECURE%20%3D%20True%60%2C%20que%20por%20sua%20vez%20requer%20%2A%2AHTTPS%2A%2A%0A-%20Sem%20HTT
PS%2C%20os%20browsers%20modernos%20simplesmente%20%2A%2An%C3%A3o%20enviam%20os%20cookies%2A%2A%20em%20contexto%20cross-origin%20%28iframe%29%2C%20o%20que%20faz%20com%20que%20o%20CSRF%20token%20da%20sess%C3%A3o%20nunca%20chegue%20ao%20Superset%0A%0AAs%20op%C3%A7%C3%B5es%20para%20resolver%20isto%20s%C3%A3o%3A%0A%0A1.%20%2A%2AUsar%20HTTPS%2A%2A%20tanto%20no%20Superset%20como%20no%20site%20que%20faz%20o%20embedding%20%28solu%C3%A7%C3%A3o%20recomendada%29%0A2.%20%2A%2ASe%20estiver%20em%20desenvolvimento%20local%2A%2A%2C%20pode%20temporariamente%20desabilitar%20CSRF%3A%0A%20%20%20%60%60%60python%0A%20%20%20WTF_CSRF_ENABLED%20%3D%20False%0A%20%20%20%60%60%60%0A%0A3.%20Se%20os%20dom%C3%ADnios%20forem%20os%20mesmos%20%28same-origin%29%2C%20pode%20usar%20%60SESSION_COOKIE_SAMESITE%20%3D%20%22Lax%22%60%20em%20vez%20de%20%60%22None%22%60%2C%20o%20que%20funciona%20sem%20HTTPS%0A%0ATamb%C3%A9m%20confirme%20que%20tem%20estas%20configura%C3%A7%C3%B5es%20no%20%60superset_config.py%60%3A%0A%0A%60%60%
60python%0AFEATURE_FLAGS%20%3D%20%7B%22EMBEDDED_SUPERSET%22%3A%20True%7D%0A%0AENABLE_CORS%20%3D%20True%0ACORS_OPTIONS%20%3D%20%7B%0A%20%20%20%20%22origins%22%3A%20%5B%22https%3A//seu-dominio.com%22%5D%2C%0A%20%20%20%20%22supports_credentials%22%3A%20True%0A%7D%0A%0ATALISMAN_ENABLED%20%3D%20True%0ATALISMAN_CONFIG%20%3D%20%7B%0A%20%20%20%20%22content_security_policy%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%22frame-ancestors%22%3A%20%5B%22%27self%27%22%2C%20%22https%3A//seu-dominio.com%22%5D%0A%20%20%20%20%7D%0A%7D%0A%60%60%60%0A%0A%5B%5B2%5D%5D%28https%3A//github.com/apache/superset/discussions/38444%29) [](https://go.dosu.dev/discord-bot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=join-discord) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=htt
ps%3A//github.com/apache/superset/discussions/39200)
GitHub link: https://github.com/apache/superset/discussions/39200#discussioncomment-16555342
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Dasboard embedded [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Dasboard embedded
<!-- Answer -->
Esse erro de CSRF é bastante comum ao configurar dashboards embutidos. O endpoint `/api/v1/security/guest_token/` **não** está na lista padrão de isenção de CSRF do Superset [[1]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py), então mesmo que o token seja gerado corretamente, as requisições subsequentes ao dashboard embutido podem falhar se os cookies de sessão e o CSRF token não estiverem sincronizados.
Aqui estão as configurações que provavelmente faltam no seu `superset_config.py`:
**1. Isentar o endpoint de CSRF (mais simples para desenvolvimento):**
```python
WTF_CSRF_EXEMPT_LIST = ["/api/v1/security/guest_token"]
```
[[2]](https://github.com/apache/superset/discussions/38444)
**2. Configurar cookies de sessão para cross-origin (obrigatório para embedding):**
```python
SESSION_COOKIE_SAMESITE = "None"
SESSION_COOKIE_SECURE = False # False para HTTP, True para HTTPS
SESSION_COOKIE_HTTPONLY = False
```
⚠️ **Nota importante**: Navegadores modernos bloqueiam cookies com `SameSite=None` quando `Secure=False` (HTTP). Isso pode ser a causa raiz do seu problema. Idealmente, use HTTPS mesmo em desenvolvimento [[3]](https://github.com/apache/superset/discussions/38444).
**3. Configurar CORS (se o PHP backend e o Superset estão em domínios/portas diferentes):**
```python
ENABLE_CORS = True
CORS_OPTIONS = {
"origins": ["http://seu-dominio-php.com"],
"supports_credentials": True
}
```
**4. Configurar Content Security Policy para permitir o iframe:**
```python
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
"content_security_policy": {
"frame-ancestors": ["'self'", "http://seu-dominio-php.com"]
}
}
```
[[4]](https://github.com/apache/superset/discussions/38444)
**5. Garantir que o feature flag está habilitado:**
```python
FEATURE_FLAGS = {
"EMBEDDED_SUPERSET": True,
}
```
Se o seu PHP backend está fazendo chamadas server-to-server para obter o `guest_token`, certifique-se de que está buscando o CSRF token primeiro via `/api/v1/security/csrf_token/` e incluindo-o no header `X-CSRFToken` junto com o cookie de sessão nas requisições POST [[5]](https://github.com/apache/superset/discussions/38444). Um erro comum é não repassar corretamente o cookie de sessão entre as chamadas [[6]](https://github.com/apache/superset/discussions/34738).
Como você está usando HTTP, o maior obstáculo vai ser que browsers modernos rejeitam `SameSite=None` sem `Secure=True`. Se possível, migre para HTTPS — mesmo com um certificado auto-assinado em desenvolvimento isso vai resolver a maioria dos problemas de cookies.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=e134e8e0-b079-494e-8bb3-15459b972e9a) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/39200#discussioncomment-16490798
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org