You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "Tranqu1lo (via GitHub)" <gi...@apache.org> on 2026/04/14 13:56:34 UTC
[D] Erro dashboard [superset]
GitHub user Tranqu1lo created a discussion: Erro dashboard
Tenho este erro
This session has encountered an interruption, and some controls may not work as intended. If you are the developer of this app, please check that the guest token is being generated correctly.
Se tiver login noutro separador mostra o grafico se tiver sem login ele dá o aviso de cima.
É seguro fazer WTF_CSRF_ENABLED = False ?
Ambos os sites têm https
GitHub link: https://github.com/apache/superset/discussions/39343
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Erro dashboard [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Erro dashboard
<!-- Answer -->
O comportamento que descreve — funcionar com login noutro separador mas falhar sem login — é o sintoma clássico de que o **dashboard embutido está a usar a sessão do browser em vez do guest token** [[1]](https://github.com/apache/superset/discussions/39200).
O que acontece: quando está com login noutro separador, o browser já tem um cookie de sessão válido e envia-o ao iframe. Sem esse login, os cookies de sessão não existem ou não estão a ser transmitidos ao iframe, e o guest token sozinho não consegue completar a autenticação porque o Superset precisa de cookies de sessão como mecanismo de transporte mesmo com guest tokens [[2]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/security/manager.py#L2641-L2672).
A causa mais provável é que os **cookies de sessão não estão correctamente configurados para cross-origin**. Verifique estas configurações no `superset_config.py`:
```python
SESSION_COOKIE_SAMESITE = "None"
SESSION_COOKIE_SECURE = True # Tem de ser True explícito, não USE_HTTPS
SESSION_COOKIE_HTTPONLY = True
ENABLE_CORS = True
CORS_OPTIONS = {
"origins": ["https://seu-site.com"],
"supports_credentials": True,
}
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
"content_security_policy": {
"frame-ancestors": ["'self'", "https://seu-site.com"]
}
}
# Se estiver atrás de proxy reverso
ENABLE_PROXY_FIX = True
```
[[1]](https://github.com/apache/superset/discussions/39200)
Pontos críticos a confirmar:
- `SESSION_COOKIE_SECURE` deve estar explicitamente como `True` — não depender de variáveis como `USE_HTTPS` [[3]](https://github.com/apache/superset/discussions/39200)
- Os `origins` no CORS devem ter o domínio **exacto** do site que faz o embed
- Após alterar a configuração, **reiniciar o Superset**
Se os cookies estiverem correctamente configurados e o erro persistir, o problema pode estar no fluxo do seu backend ao gerar o guest token — deve buscar o CSRF token via `/api/v1/security/csrf_token/` e incluí-lo no header `X-CSRFToken` nas chamadas POST [[1]](https://github.com/apache/superset/discussions/39200).
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=6e29fedc-35e8-4eee-b264-674fe8b944be) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/39343#discussioncomment-16557889
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Erro dashboard [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Erro dashboard
<!-- Answer -->
Este erro é exactamente o mesmo problema que foi discutido [nesta thread recente](https://github.com/apache/superset/discussions/39200#discussioncomment-16554639) — o dashboard embutido não consegue obter o CSRF token porque os cookies de sessão não estão a chegar ao Superset no contexto do iframe.
**Não é recomendado usar `WTF_CSRF_ENABLED = False` em produção** — isso desativa a proteção CSRF para **todas** as rotas, o que expõe o Superset a ataques CSRF [[1]](https://github.com/apache/superset/discussions/38444).
Como ambos os sites já têm HTTPS, a solução correcta é garantir que tem **todas** estas configurações no `superset_config.py`:
```python
FEATURE_FLAGS = {"EMBEDDED_SUPERSET": True}
# Cookies de sessão para cross-origin (iframe)
SESSION_COOKIE_SAMESITE = "None"
SESSION_COOKIE_SECURE = True # Obrigatório com SameSite=None
SESSION_COOKIE_HTTPONLY = True
# CORS — substituir pelo domínio real do seu site
ENABLE_CORS = True
CORS_OPTIONS = {
"origins": ["https://seu-site.com"],
"supports_credentials": True,
}
# CSP — permitir o iframe
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
"content_security_policy": {
"frame-ancestors": ["'self'", "https://seu-site.com"]
}
}
# Se estiver atrás de proxy reverso (Nginx, etc.)
ENABLE_PROXY_FIX = True
```
[[2]](https://github.com/apache/superset/discussions/39200)
Se o erro persistir apenas no endpoint do guest token, pode isentar apenas esse endpoint em vez de desativar o CSRF globalmente:
```python
WTF_CSRF_EXEMPT_LIST = ["/api/v1/security/guest_token"]
```
[[1]](https://github.com/apache/superset/discussions/38444)
Confirme também que no backend que gera o guest token, está a buscar o CSRF token primeiro via `/api/v1/security/csrf_token/` e a enviá-lo no header `X-CSRFToken` nas chamadas POST [[2]](https://github.com/apache/superset/discussions/39200). Após alterar a configuração, reinicie o Superset.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=brand-link).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-great_response#message_id=44978ec4-9c15-453c-984f-ac10b4cc87cb&feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-irrelevant_answer#message_id=44978ec4-9c15-453c-984f-ac10b4cc87cb&feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-incorrect_sources#message_id=44978ec4-9c15-453c-984f-ac10b4cc87cb&feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-too_verbose#message_id=44978ec4-9c15-453c-984f-ac10b4cc87cb&feedback_type=too_verbose) | [Hallucination](https://app
.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-hallucination#message_id=44978ec4-9c15-453c-984f-ac10b4cc87cb&feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-bug_report#message_id=44978ec4-9c15-453c-984f-ac10b4cc87cb&feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-other#message_id=44978ec4-9c15-453c-984f-ac10b4cc87cb&feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=chat-badge) [](https://cursor.com/link/prompt?text=Este%20erro%20%C3%A9%20exactamente%20o%20mesmo%20problema%20que%20foi%20discutido%20%5Bnesta%20thread%20recente%5D%28https%3A//github.com/apache/superset/discussions/39200%23discussioncomment-16554639%29%20%E2%80%94%20o%20dashboard%20embutido%20n%C3%A3o%20consegue%20obter%20o%20CSRF%20token%20porque%20os%20cookies%20de%20sess%C3%A3o%20n%C3%A3o%20est%C3%A3o%20a%20chegar%20ao%20Superset%20no%20contexto%20do%20iframe.%0A%0A%2A%2AN%C3%A3o%20%C3%A9%20recomendado%20usar%20%60WTF_CSRF_ENABLED%20%3D%20False%60%20em%20produ%C3%A7%C3%A3o%2A%2A%20%E2%80%94%20isso%20desativa%20a%20prote%C3%A7%C3%A3o%20CSRF%20para%20%2A%2Atodas%2A%2A%20as%20rotas%2C%20o%20que%20exp%C3%B5e%20o%20Superset%20
a%20ataques%20CSRF%20%5B%5B1%5D%5D%28https%3A//github.com/apache/superset/discussions/38444%29.%0A%0AComo%20ambos%20os%20sites%20j%C3%A1%20t%C3%AAm%20HTTPS%2C%20a%20solu%C3%A7%C3%A3o%20correcta%20%C3%A9%20garantir%20que%20tem%20%2A%2Atodas%2A%2A%20estas%20configura%C3%A7%C3%B5es%20no%20%60superset_config.py%60%3A%0A%0A%60%60%60python%0AFEATURE_FLAGS%20%3D%20%7B%22EMBEDDED_SUPERSET%22%3A%20True%7D%0A%0A%23%20Cookies%20de%20sess%C3%A3o%20para%20cross-origin%20%28iframe%29%0ASESSION_COOKIE_SAMESITE%20%3D%20%22None%22%0ASESSION_COOKIE_SECURE%20%3D%20True%20%20%20%20%20%20%23%20Obrigat%C3%B3rio%20com%20SameSite%3DNone%0ASESSION_COOKIE_HTTPONLY%20%3D%20True%0A%0A%23%20CORS%20%E2%80%94%20substituir%20pelo%20dom%C3%ADnio%20real%20do%20seu%20site%0AENABLE_CORS%20%3D%20True%0ACORS_OPTIONS%20%3D%20%7B%0A%20%20%20%20%22origins%22%3A%20%5B%22https%3A//seu-site.com%22%5D%2C%0A%20%20%20%20%22supports_credentials%22%3A%20True%2C%0A%7D%0A%0A%23%20CSP%20%E2%80%94%20permitir%20o%20iframe%0ATALISMAN_EN
ABLED%20%3D%20True%0ATALISMAN_CONFIG%20%3D%20%7B%0A%20%20%20%20%22content_security_policy%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%22frame-ancestors%22%3A%20%5B%22%27self%27%22%2C%20%22https%3A//seu-site.com%22%5D%0A%20%20%20%20%7D%0A%7D%0A%0A%23%20Se%20estiver%20atr%C3%A1s%20de%20proxy%20reverso%20%28Nginx%2C%20etc.%29%0AENABLE_PROXY_FIX%20%3D%20True%0A%60%60%60%0A%0A%5B%5B2%5D%5D%28https%3A//github.com/apache/superset/discussions/39200%29%0A%0ASe%20o%20erro%20persistir%20apenas%20no%20endpoint%20do%20guest%20token%2C%20pode%20isentar%20apenas%20esse%20endpoint%20em%20vez%20de%20desativar%20o%20CSRF%20globalmente%3A%0A%0A%60%60%60python%0AWTF_CSRF_EXEMPT_LIST%20%3D%20%5B%22/api/v1/security/guest_token%22%5D%0A%60%60%60%0A%0A%5B%5B1%5D%5D%28https%3A//github.com/apache/superset/discussions/38444%29%0A%0AConfirme%20tamb%C3%A9m%20que%20no%20backend%20que%20gera%20o%20guest%20token%2C%20est%C3%A1%20a%20buscar%20o%20CSRF%20token%20primeiro%20via%20%60/api/v1/security/csrf_token/%60%20e%20a
%20envi%C3%A1-lo%20no%20header%20%60X-CSRFToken%60%20nas%20chamadas%20POST%20%5B%5B2%5D%5D%28https%3A//github.com/apache/superset/discussions/39200%29.%20Ap%C3%B3s%20alterar%20a%20configura%C3%A7%C3%A3o%2C%20reinicie%20o%20Superset.) [](https://go.dosu.dev/discord-bot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=join-discord) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/39343)
GitHub link: https://github.com/apache/superset/discussions/39343#discussioncomment-16557703
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Erro dashboard [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Erro dashboard
<!-- Answer -->
Este erro é exactamente o mesmo problema que foi discutido [nesta thread recente](https://github.com/apache/superset/discussions/39200#discussioncomment-16554639) — o dashboard embutido não consegue obter o CSRF token porque os cookies de sessão não estão a chegar ao Superset no contexto do iframe.
**Não é recomendado usar `WTF_CSRF_ENABLED = False` em produção** — isso desativa a proteção CSRF para **todas** as rotas, o que expõe o Superset a ataques CSRF [[1]](https://github.com/apache/superset/discussions/38444).
Como ambos os sites já têm HTTPS, a solução correcta é garantir que tem **todas** estas configurações no `superset_config.py`:
```python
FEATURE_FLAGS = {"EMBEDDED_SUPERSET": True}
# Cookies de sessão para cross-origin (iframe)
SESSION_COOKIE_SAMESITE = "None"
SESSION_COOKIE_SECURE = True # Obrigatório com SameSite=None
SESSION_COOKIE_HTTPONLY = True
# CORS — substituir pelo domínio real do seu site
ENABLE_CORS = True
CORS_OPTIONS = {
"origins": ["https://seu-site.com"],
"supports_credentials": True,
}
# CSP — permitir o iframe
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
"content_security_policy": {
"frame-ancestors": ["'self'", "https://seu-site.com"]
}
}
# Se estiver atrás de proxy reverso (Nginx, etc.)
ENABLE_PROXY_FIX = True
```
[[2]](https://github.com/apache/superset/discussions/39200)
Se o erro persistir apenas no endpoint do guest token, pode isentar apenas esse endpoint em vez de desativar o CSRF globalmente:
```python
WTF_CSRF_EXEMPT_LIST = ["/api/v1/security/guest_token"]
```
[[1]](https://github.com/apache/superset/discussions/38444)
Confirme também que no backend que gera o guest token, está a buscar o CSRF token primeiro via `/api/v1/security/csrf_token/` e a enviá-lo no header `X-CSRFToken` nas chamadas POST [[2]](https://github.com/apache/superset/discussions/39200). Após alterar a configuração, reinicie o Superset.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=44978ec4-9c15-453c-984f-ac10b4cc87cb) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/39343#discussioncomment-16557703
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Erro dashboard [superset]
Posted by "Tranqu1lo (via GitHub)" <gi...@apache.org>.
GitHub user Tranqu1lo added a comment to the discussion: Erro dashboard
O dashboard funciona se tiver login noutro separador caso contrario dá erro
GitHub link: https://github.com/apache/superset/discussions/39343#discussioncomment-16557803
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Erro dashboard [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Erro dashboard
<!-- Answer -->
O comportamento que descreve — funcionar com login noutro separador mas falhar sem login — é o sintoma clássico de que o **dashboard embutido está a usar a sessão do browser em vez do guest token** [[1]](https://github.com/apache/superset/discussions/39200).
O que acontece: quando está com login noutro separador, o browser já tem um cookie de sessão válido e envia-o ao iframe. Sem esse login, os cookies de sessão não existem ou não estão a ser transmitidos ao iframe, e o guest token sozinho não consegue completar a autenticação porque o Superset precisa de cookies de sessão como mecanismo de transporte mesmo com guest tokens [[2]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/security/manager.py#L2641-L2672).
A causa mais provável é que os **cookies de sessão não estão correctamente configurados para cross-origin**. Verifique estas configurações no `superset_config.py`:
```python
SESSION_COOKIE_SAMESITE = "None"
SESSION_COOKIE_SECURE = True # Tem de ser True explícito, não USE_HTTPS
SESSION_COOKIE_HTTPONLY = True
ENABLE_CORS = True
CORS_OPTIONS = {
"origins": ["https://seu-site.com"],
"supports_credentials": True,
}
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
"content_security_policy": {
"frame-ancestors": ["'self'", "https://seu-site.com"]
}
}
# Se estiver atrás de proxy reverso
ENABLE_PROXY_FIX = True
```
[[1]](https://github.com/apache/superset/discussions/39200)
Pontos críticos a confirmar:
- `SESSION_COOKIE_SECURE` deve estar explicitamente como `True` — não depender de variáveis como `USE_HTTPS` [[3]](https://github.com/apache/superset/discussions/39200)
- Os `origins` no CORS devem ter o domínio **exacto** do site que faz o embed
- Após alterar a configuração, **reiniciar o Superset**
Se os cookies estiverem correctamente configurados e o erro persistir, o problema pode estar no fluxo do seu backend ao gerar o guest token — deve buscar o CSRF token via `/api/v1/security/csrf_token/` e incluí-lo no header `X-CSRFToken` nas chamadas POST [[1]](https://github.com/apache/superset/discussions/39200).
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=brand-link).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-great_response#message_id=6e29fedc-35e8-4eee-b264-674fe8b944be&feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-irrelevant_answer#message_id=6e29fedc-35e8-4eee-b264-674fe8b944be&feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-incorrect_sources#message_id=6e29fedc-35e8-4eee-b264-674fe8b944be&feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-too_verbose#message_id=6e29fedc-35e8-4eee-b264-674fe8b944be&feedback_type=too_verbose) | [Hallucination](https://app
.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-hallucination#message_id=6e29fedc-35e8-4eee-b264-674fe8b944be&feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-bug_report#message_id=6e29fedc-35e8-4eee-b264-674fe8b944be&feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=feedback-other#message_id=6e29fedc-35e8-4eee-b264-674fe8b944be&feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=chat-badge) [](https://cursor.com/link/prompt?text=O%20comportamento%20que%20descreve%20%E2%80%94%20funcionar%20com%20login%20noutro%20separador%20mas%20falhar%20sem%20login%20%E2%80%94%20%C3%A9%20o%20sintoma%20cl%C3%A1ssico%20de%20que%20o%20%2A%2Adashboard%20embutido%20est%C3%A1%20a%20usar%20a%20sess%C3%A3o%20do%20browser%20em%20vez%20do%20guest%20token%2A%2A%20%5B%5B1%5D%5D%28https%3A//github.com/apache/superset/discussions/39200%29.%0A%0AO%20que%20acontece%3A%20quando%20est%C3%A1%20com%20login%20noutro%20separador%2C%20o%20browser%20j%C3%A1%20tem%20um%20cookie%20de%20sess%C3%A3o%20v%C3%A1lido%20e%20envia-o%20ao%20iframe.%20Sem%20esse%20login%2C%20os%20cookies%20de%20sess%C3%A3o%20n%C3%A3o%20existem%20ou%20n%C3%A3o%20est%C3%
A3o%20a%20ser%20transmitidos%20ao%20iframe%2C%20e%20o%20guest%20token%20sozinho%20n%C3%A3o%20consegue%20completar%20a%20autentica%C3%A7%C3%A3o%20porque%20o%20Superset%20precisa%20de%20cookies%20de%20sess%C3%A3o%20como%20mecanismo%20de%20transporte%20mesmo%20com%20guest%20tokens%20%5B%5B2%5D%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/security/manager.py%23L2641-L2672%29.%0A%0AA%20causa%20mais%20prov%C3%A1vel%20%C3%A9%20que%20os%20%2A%2Acookies%20de%20sess%C3%A3o%20n%C3%A3o%20est%C3%A3o%20correctamente%20configurados%20para%20cross-origin%2A%2A.%20Verifique%20estas%20configura%C3%A7%C3%B5es%20no%20%60superset_config.py%60%3A%0A%0A%60%60%60python%0ASESSION_COOKIE_SAMESITE%20%3D%20%22None%22%0ASESSION_COOKIE_SECURE%20%3D%20True%20%20%20%20%20%20%20%23%20Tem%20de%20ser%20True%20expl%C3%ADcito%2C%20n%C3%A3o%20USE_HTTPS%0ASESSION_COOKIE_HTTPONLY%20%3D%20True%0A%0AENABLE_CORS%20%3D%20True%0ACORS_OPTIONS%20%3D%20%7B%0A%20%20%20%20%22origi
ns%22%3A%20%5B%22https%3A//seu-site.com%22%5D%2C%0A%20%20%20%20%22supports_credentials%22%3A%20True%2C%0A%7D%0A%0ATALISMAN_ENABLED%20%3D%20True%0ATALISMAN_CONFIG%20%3D%20%7B%0A%20%20%20%20%22content_security_policy%22%3A%20%7B%0A%20%20%20%20%20%20%20%20%22frame-ancestors%22%3A%20%5B%22%27self%27%22%2C%20%22https%3A//seu-site.com%22%5D%0A%20%20%20%20%7D%0A%7D%0A%0A%23%20Se%20estiver%20atr%C3%A1s%20de%20proxy%20reverso%0AENABLE_PROXY_FIX%20%3D%20True%0A%60%60%60%0A%0A%5B%5B1%5D%5D%28https%3A//github.com/apache/superset/discussions/39200%29%0A%0APontos%20cr%C3%ADticos%20a%20confirmar%3A%0A%0A-%20%60SESSION_COOKIE_SECURE%60%20deve%20estar%20explicitamente%20como%20%60True%60%20%E2%80%94%20n%C3%A3o%20depender%20de%20vari%C3%A1veis%20como%20%60USE_HTTPS%60%20%5B%5B3%5D%5D%28https%3A//github.com/apache/superset/discussions/39200%29%0A-%20Os%20%60origins%60%20no%20CORS%20devem%20ter%20o%20dom%C3%ADnio%20%2A%2Aexacto%2A%2A%20do%20site%20que%20faz%20o%20embed%0A-%20Ap%C3%B3s%20alterar%20a%20c
onfigura%C3%A7%C3%A3o%2C%20%2A%2Areiniciar%20o%20Superset%2A%2A%0A%0ASe%20os%20cookies%20estiverem%20correctamente%20configurados%20e%20o%20erro%20persistir%2C%20o%20problema%20pode%20estar%20no%20fluxo%20do%20seu%20backend%20ao%20gerar%20o%20guest%20token%20%E2%80%94%20deve%20buscar%20o%20CSRF%20token%20via%20%60/api/v1/security/csrf_token/%60%20e%20inclu%C3%AD-lo%20no%20header%20%60X-CSRFToken%60%20nas%20chamadas%20POST%20%5B%5B1%5D%5D%28https%3A//github.com/apache/superset/discussions/39200%29.) [](https://go.dosu.dev/discord-bot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-assistant&utm_content=join-discord) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/39343)
GitHub link: https://github.com/apache/superset/discussions/39343#discussioncomment-16557889
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org