You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "dosubot[bot] (via GitHub)" <gi...@apache.org> on 2026/05/02 02:57:34 UTC
Re: [D] OAuth Zitadel Login Fails on Remote Superset (mismatching_state CSRF error) [superset]
GitHub user dosubot[bot] edited a comment on the discussion: OAuth Zitadel Login Fails on Remote Superset (mismatching_state CSRF error)
<!-- Answer -->
This CSRF "mismatching_state" error in Superset OAuth is almost always caused by differences in session or proxy configuration between environments. The most common fixes are:
- If you are on Superset 3.0.0–3.0.2 and not using HTTPS, add `"session_cookie_secure": False` to your Talisman CSP config. This is required for cookies to work over HTTP and for the OAuth state to persist correctly. This issue is fixed in 3.1.0 and later, so upgrading is the best long-term solution ([source](https://github.com/apache/superset/discussions/32979), [source](https://github.com/apache/superset/discussions/31440)).
- Make sure `ENABLE_PROXY_FIX = True` is set if you are behind a proxy or load balancer, or if SSL offloading is involved. This ensures the `redirect_uri` is computed correctly and the state parameter is preserved ([source](https://github.com/apache/superset/issues/31435)).
- For multi-worker deployments (like gunicorn), set `SESSION_SERVER_SIDE = True` and use a persistent session backend (such as Redis). Otherwise, session data (including the OAuth state) can be lost between requests, causing this error ([source](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py)).
- Double-check that your `SECRET_KEY` is identical in both environments and that session/cookie settings (`SESSION_COOKIE_SECURE`, `SESSION_COOKIE_SAMESITE`, etc.) match.
If you’ve already tried these and are still seeing the error, please share your Superset version, whether HTTPS is enabled, and your session/security config for both environments. This will help pinpoint the root cause.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=cb259212-38b5-4f21-ba63-ef20a7445718) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/34783#discussioncomment-14172184
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org