You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "dosubot[bot] (via GitHub)" <gi...@apache.org> on 2026/05/02 03:17:07 UTC
Re: [D] Erro dashboard [superset]
GitHub user dosubot[bot] edited a comment on the discussion: Erro dashboard
<!-- Answer -->
Este erro é exactamente o mesmo problema que foi discutido [nesta thread recente](https://github.com/apache/superset/discussions/39200#discussioncomment-16554639) — o dashboard embutido não consegue obter o CSRF token porque os cookies de sessão não estão a chegar ao Superset no contexto do iframe.
**Não é recomendado usar `WTF_CSRF_ENABLED = False` em produção** — isso desativa a proteção CSRF para **todas** as rotas, o que expõe o Superset a ataques CSRF [[1]](https://github.com/apache/superset/discussions/38444).
Como ambos os sites já têm HTTPS, a solução correcta é garantir que tem **todas** estas configurações no `superset_config.py`:
```python
FEATURE_FLAGS = {"EMBEDDED_SUPERSET": True}
# Cookies de sessão para cross-origin (iframe)
SESSION_COOKIE_SAMESITE = "None"
SESSION_COOKIE_SECURE = True # Obrigatório com SameSite=None
SESSION_COOKIE_HTTPONLY = True
# CORS — substituir pelo domínio real do seu site
ENABLE_CORS = True
CORS_OPTIONS = {
"origins": ["https://seu-site.com"],
"supports_credentials": True,
}
# CSP — permitir o iframe
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
"content_security_policy": {
"frame-ancestors": ["'self'", "https://seu-site.com"]
}
}
# Se estiver atrás de proxy reverso (Nginx, etc.)
ENABLE_PROXY_FIX = True
```
[[2]](https://github.com/apache/superset/discussions/39200)
Se o erro persistir apenas no endpoint do guest token, pode isentar apenas esse endpoint em vez de desativar o CSRF globalmente:
```python
WTF_CSRF_EXEMPT_LIST = ["/api/v1/security/guest_token"]
```
[[1]](https://github.com/apache/superset/discussions/38444)
Confirme também que no backend que gera o guest token, está a buscar o CSRF token primeiro via `/api/v1/security/csrf_token/` e a enviá-lo no header `X-CSRFToken` nas chamadas POST [[2]](https://github.com/apache/superset/discussions/39200). Após alterar a configuração, reinicie o Superset.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=44978ec4-9c15-453c-984f-ac10b4cc87cb) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/39343#discussioncomment-16557703
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org