You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "KunfuPanda24 (via GitHub)" <gi...@apache.org> on 2025/09/08 11:59:59 UTC
[D] Deploying Apache superset (Version : 2.0.0) frontend and backend separately [superset]
GitHub user KunfuPanda24 created a discussion: Deploying Apache superset (Version : 2.0.0) frontend and backend separately
Hi Guys, on deploying apache superset behind gateway i am able to access all the backend api's using postman but all frontend routes like /static are throwing error ( as gateway needs bearer token). And it is also not a correct way to deploy frontend. To solve this problem, i am thinking of following solution.
Superset Frontend: Update all the hardcoded routes to the configureable backend gateway url + bearer token
Will this approach work / any alternate solutions available ? Will it cause any major security Vulnerability ?
GitHub link: https://github.com/apache/superset/discussions/35055
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Deploying Apache superset (Version : 2.0.0) frontend and backend separately [superset]
Posted by "KunfuPanda24 (via GitHub)" <gi...@apache.org>.
GitHub user KunfuPanda24 edited a discussion: Deploying Apache superset (Version : 2.0.0) frontend and backend separately
Hi Guys, on deploying apache superset behind gateway i am able to access all the backend api's using postman but all frontend routes like /static are throwing error ( as gateway needs bearer token). And it is also not a correct way to deploy frontend. To solve this problem, i am thinking of following solution.
Superset Frontend: Update all the hardcoded routes to the configureable backend gateway url + bearer token
Only superset backend will be deployed behind the gateway.
Will this approach work / any alternate solutions available ? Will it cause any major security Vulnerability ?
GitHub link: https://github.com/apache/superset/discussions/35055
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Deploying Apache superset (Version : 2.0.0) frontend and backend separately [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Deploying Apache superset (Version : 2.0.0) frontend and backend separately
<!-- Greeting -->
Hi @KunfuPanda24! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the superset team.
<!-- Answer -->
Deploying Superset v2.0.0 with the frontend and backend separately behind a gateway is not straightforward or officially supported. The frontend expects to fetch APIs and static files relative to paths injected by the backend at runtime, not via externally provided configs. While the SupersetClient library allows some configuration of backend URLs and headers, the overall architecture assumes a monolithic deployment model, and static asset routes like `/static` are not managed by the frontend client—they must be served directly by the gateway or web server without authentication barriers for the UI to work properly [[code reference](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/packages/superset-ui-core/src/connection/SupersetClientClass.ts)].
Trying to update hardcoded frontend routes or inject bearer tokens for static assets is risky and likely to break features, especially authentication and asset delivery. This approach can introduce major security vulnerabilities, such as exposing tokens in client-side code and making maintenance difficult [[discussion](https://github.com/apache/superset/discussions/31570)].
Best practice is to configure your gateway or reverse proxy to allow unauthenticated access to static assets (like `/static`) while enforcing authentication only for API endpoints. If your gateway cannot do this, consider deploying Superset on a dedicated DNS/host rule rather than a subpath, which avoids many routing and asset issues [[discussion](https://github.com/apache/superset/discussions/31570)]. For robust subpath support, upgrading to Superset 6.0+ is recommended, as earlier versions have known bugs and limitations with this deployment pattern [[issue](https://github.com/apache/superset/issues/34896)].
In summary: modifying frontend code for bearer tokens and gateway URLs is not recommended. Focus on proxy/gateway configuration to serve static assets correctly and avoid authentication on those routes.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/3ac7787b-2b99-40ce-a618-8afe0d6b076c?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/3ac7787b-2b99-40ce-a618-8afe0d6b076c?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/3ac7787b-2b99-40ce-a618-8afe0d6b076c?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/3ac7787b-2b99-40ce-a618-8afe0d6b076c?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/3ac7787b-2b99-40ce-a618-8afe0d6b076c?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/3ac7787b-2b99-40ce-a618-8afe0d6b076c?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/3ac7787b-2b99-40ce-a618-8afe0d6b076c?feedback_type=other)</sup> [](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github)&
nbsp;[](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/35055)
GitHub link: https://github.com/apache/superset/discussions/35055#discussioncomment-14339773
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Deploying Apache superset (Version : 2.0.0) frontend and backend separately [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Deploying Apache superset (Version : 2.0.0) frontend and backend separately
<!-- Greeting -->
Hi @KunfuPanda24! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the superset team.
<!-- Answer -->
Deploying Superset v2.0.0 with the frontend and backend separately behind a gateway is not straightforward or officially supported. The frontend expects to fetch APIs and static files relative to paths injected by the backend at runtime, not via externally provided configs. While the SupersetClient library allows some configuration of backend URLs and headers, the overall architecture assumes a monolithic deployment model, and static asset routes like `/static` are not managed by the frontend client—they must be served directly by the gateway or web server without authentication barriers for the UI to work properly [[code reference](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/packages/superset-ui-core/src/connection/SupersetClientClass.ts)].
Trying to update hardcoded frontend routes or inject bearer tokens for static assets is risky and likely to break features, especially authentication and asset delivery. This approach can introduce major security vulnerabilities, such as exposing tokens in client-side code and making maintenance difficult [[discussion](https://github.com/apache/superset/discussions/31570)].
Best practice is to configure your gateway or reverse proxy to allow unauthenticated access to static assets (like `/static`) while enforcing authentication only for API endpoints. If your gateway cannot do this, consider deploying Superset on a dedicated DNS/host rule rather than a subpath, which avoids many routing and asset issues [[discussion](https://github.com/apache/superset/discussions/31570)]. For robust subpath support, upgrading to Superset 6.0+ is recommended, as earlier versions have known bugs and limitations with this deployment pattern [[issue](https://github.com/apache/superset/issues/34896)].
In summary: modifying frontend code for bearer tokens and gateway URLs is not recommended. Focus on proxy/gateway configuration to serve static assets correctly and avoid authentication on those routes.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=3ac7787b-2b99-40ce-a618-8afe0d6b076c) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/35055#discussioncomment-14339773
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Deploying Apache superset (Version : 2.0.0) frontend and backend separately [superset]
Posted by "KunfuPanda24 (via GitHub)" <gi...@apache.org>.
GitHub user KunfuPanda24 added a comment to the discussion: Deploying Apache superset (Version : 2.0.0) frontend and backend separately
@dosu My idea is to update the relative path of the backend api's like /api/v1 to the gateway url along with bearer token. And all the frontend will be unauthenticated from different domain. So all the frontend routes can work without any authentication and only the backend api's will be behind the api gateway.
GitHub link: https://github.com/apache/superset/discussions/35055#discussioncomment-14340449
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Deploying Apache superset (Version : 2.0.0) frontend and backend separately [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Deploying Apache superset (Version : 2.0.0) frontend and backend separately
<!-- Answer -->
Your approach—configuring the frontend to target backend API endpoints at a gateway URL with bearer tokens, while serving the frontend unauthenticated from a different domain—can work technically, but there are important caveats and risks.
Superset's frontend client (SupersetClient) is highly configurable: you can set the backend API URL, add custom headers (including bearer tokens), and enable CORS mode for cross-origin requests if the backend is configured to allow it. This means you can direct API calls from the frontend to a protected backend behind your gateway, as long as you set ENABLE_CORS = True and configure CORS_OPTIONS to allow requests from your frontend domain [[code reference](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/packages/superset-ui-core/src/connection/README.md)].
However, static assets (like `/static`) are not managed by the frontend client and must be served directly by your gateway or web server without authentication. The frontend does not inject tokens for static asset requests, so your gateway must allow unauthenticated access to these routes for the UI to work. Trying to inject tokens or rewrite static asset URLs in the frontend is not supported and will likely break features or introduce security issues [[code reference](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py)].
This deployment pattern is not officially documented or recommended in Superset v2.0.0. While it can be made to work with careful configuration, you may encounter edge cases or regressions, especially with authentication flows and embedded features. For long-term stability, the best practice is to configure your gateway to allow unauthenticated access to static assets and only protect API endpoints, or to deploy Superset on a dedicated host or DNS rule.
If you proceed, make sure to review your CORS, static asset, and authentication configurations carefully to avoid exposing sensitive endpoints or breaking the UI.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=a2cc9311-c694-4a13-80fd-196fba4b3455) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/35055#discussioncomment-14340489
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Deploying Apache superset (Version : 2.0.0) frontend and backend separately [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Deploying Apache superset (Version : 2.0.0) frontend and backend separately
<!-- Answer -->
Your approach—configuring the frontend to target backend API endpoints at a gateway URL with bearer tokens, while serving the frontend unauthenticated from a different domain—can work technically, but there are important caveats and risks.
Superset's frontend client (SupersetClient) is highly configurable: you can set the backend API URL, add custom headers (including bearer tokens), and enable CORS mode for cross-origin requests if the backend is configured to allow it. This means you can direct API calls from the frontend to a protected backend behind your gateway, as long as you set ENABLE_CORS = True and configure CORS_OPTIONS to allow requests from your frontend domain [[code reference](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset-frontend/packages/superset-ui-core/src/connection/README.md)].
However, static assets (like `/static`) are not managed by the frontend client and must be served directly by your gateway or web server without authentication. The frontend does not inject tokens for static asset requests, so your gateway must allow unauthenticated access to these routes for the UI to work. Trying to inject tokens or rewrite static asset URLs in the frontend is not supported and will likely break features or introduce security issues [[code reference](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py)].
This deployment pattern is not officially documented or recommended in Superset v2.0.0. While it can be made to work with careful configuration, you may encounter edge cases or regressions, especially with authentication flows and embedded features. For long-term stability, the best practice is to configure your gateway to allow unauthenticated access to static assets and only protect API endpoints, or to deploy Superset on a dedicated host or DNS rule.
If you proceed, make sure to review your CORS, static asset, and authentication configurations carefully to avoid exposing sensitive endpoints or breaking the UI.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/a2cc9311-c694-4a13-80fd-196fba4b3455?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/a2cc9311-c694-4a13-80fd-196fba4b3455?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/a2cc9311-c694-4a13-80fd-196fba4b3455?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/a2cc9311-c694-4a13-80fd-196fba4b3455?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/a2cc9311-c694-4a13-80fd-196fba4b3455?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/a2cc9311-c694-4a13-80fd-196fba4b3455?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/a2cc9311-c694-4a13-80fd-196fba4b3455?feedback_type=other)</sup> [](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github)&
nbsp;[](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/35055)
GitHub link: https://github.com/apache/superset/discussions/35055#discussioncomment-14340489
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org