You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "loktar00 (via GitHub)" <gi...@apache.org> on 2023/07/26 18:37:03 UTC
[GitHub] [superset] loktar00 opened a new issue, #24818: Unable to open swagger on local host due to violating Content Security Policy error.
loktar00 opened a new issue, #24818:
URL: https://github.com/apache/superset/issues/24818
I have Swagger enabled in the config via `FAB_API_SWAGGER_UI = True`
When attempting to go to the URL (and logging in as admin) I see the following in Brave and Edge
```
Refused to load the stylesheet 'https://cdn.jsdelivr.net/npm/swagger-ui-dist@4/swagger-ui.css' because it violates the following Content Security Policy directive: "style-src 'self' 'unsafe-inline'". Note that 'style-src-elem' was not explicitly set, so 'style-src' is used as a fallback.
v1:55 Refused to load the image 'https://fastapi.tiangolo.com/img/favicon.png' because it violates the following Content Security Policy directive: "img-src 'self' data:".
v1:155 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'strict-dynamic' 'nonce-LOs8l9GOnAS1e1K0ek9wV9aSEaJneEQQ'". Either the 'unsafe-inline' keyword, a hash ('sha256-1r8ykd7la2sNxnDBtNms0TqO7HUtu35cLQvWmZ7Tm64='), or a nonce ('nonce-...') is required to enable inline execution.
```
This is a very vanilla / new setup with no additional configuration done.
#### How to reproduce the bug
1. Enable Swagger
2. Go to '`http://localhost:8088/swagger/v1`
3. You're presented with a white content area and errors in the console.
### Expected results
Swagger documentation loads
### Actual results
Only the header loads.
#### Screenshots
If applicable, add screenshots to help explain your problem.
### Environment
- browser type and version: Brave v1.56.11
- superset version: `superset version`
- python version: `3.9.17`
- any feature flags active: `{"ALERT_REPORTS": True, "EMBEDDED_SUPERSET": True}`
### Checklist
Make sure to follow these steps before submitting your issue - thank you!
- [X] I have checked the superset logs for python stacktraces and included it here as text if there are any.
- [X] I have reproduced the issue with at least the latest released version of superset.
- [X] I have checked the issue tracker for the same issue and I haven't found one similar.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] sebastianliebscher commented on issue #24818: Unable to open swagger on local host due to violating Content Security Policy error.
Posted by "sebastianliebscher (via GitHub)" <gi...@apache.org>.
sebastianliebscher commented on issue #24818:
URL: https://github.com/apache/superset/issues/24818#issuecomment-1656950548
I could replicate this. https://github.com/apache/superset/issues/24616 did not fix the issue
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] loktar00 commented on issue #24818: Unable to open swagger on local host due to violating Content Security Policy error.
Posted by "loktar00 (via GitHub)" <gi...@apache.org>.
loktar00 commented on issue #24818:
URL: https://github.com/apache/superset/issues/24818#issuecomment-1658539334
> I could replicate this. #24616 did not fix the issue
Ah I actually didn't see that issue when searching otherwise I would have commented on that. Glad it's reproduceable was worried _maybe_ it was somehow a local thing.
I should also mention I am on Windows but using WSL2 / Docker. Might not make a difference but worth mentioning.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] huamichaelchen commented on issue #24818: Unable to open swagger on local host due to violating Content Security Policy error.
Posted by "huamichaelchen (via GitHub)" <gi...@apache.org>.
huamichaelchen commented on issue #24818:
URL: https://github.com/apache/superset/issues/24818#issuecomment-1701446606
I suspect all you need is to add `style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net/npm/swagger-ui-dist@4/swagger-ui.css;` into your CSP.
Wrote a guide on it, hopefully, it helps someone 😄 Choose your preferred media 😝
https://huamichaelchen.substack.com/p/end-to-end-example-of-setting-up
https://medium.com/@huamichaelchen/end-to-end-example-of-setting-up-superset-embedded-dashboard-f72fc985559
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
[GitHub] [superset] dpgaspar closed issue #24818: Unable to open swagger on local host due to violating Content Security Policy error.
Posted by "dpgaspar (via GitHub)" <gi...@apache.org>.
dpgaspar closed issue #24818: Unable to open swagger on local host due to violating Content Security Policy error.
URL: https://github.com/apache/superset/issues/24818
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Unable to open swagger on local host due to violating Content Security Policy error. [superset]
Posted by "vikashrajgupta (via GitHub)" <gi...@apache.org>.
vikashrajgupta commented on issue #24818:
URL: https://github.com/apache/superset/issues/24818#issuecomment-2037357150
I'm getting this CSP violation issue only when I'm using superset via the domain name, without the domain it's working fine.
For example, I'm running this on _localhost:9888_ and when I'm using this via domain, it shows a CSP error.
That would be great if you guys could help!!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Unable to open swagger on local host due to violating Content Security Policy error. [superset]
Posted by "manishkr21 (via GitHub)" <gi...@apache.org>.
manishkr21 commented on issue #24818:
URL: https://github.com/apache/superset/issues/24818#issuecomment-3892240962
in my case setting "Header set Content-Security-Policy "img-src 'self' data: https://fastapi.tiangolo.com;" in apache config file works
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org