[incubator-superset] branch master updated: Adding hook for CSRF exempting flask views. (#3435)

[ma...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

maximebeauchemin pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-superset.git


The following commit(s) were added to refs/heads/master by this push:
     new e22aecb  Adding hook for CSRF exempting flask views. (#3435)
e22aecb is described below

commit e22aecb0d1244bae49d3e5b36ef2f9ddc7517c1a
Author: fabianmenges <fa...@users.noreply.github.com>
AuthorDate: Thu Sep 14 23:54:18 2017 -0400

    Adding hook for CSRF exempting flask views. (#3435)
---
 docs/installation.rst | 7 +++++++
 superset/__init__.py  | 3 +++
 superset/config.py    | 3 +++
 3 files changed, 13 insertions(+)

diff --git a/docs/installation.rst b/docs/installation.rst
index 9cd3de6..1449fb7 100644
--- a/docs/installation.rst
+++ b/docs/installation.rst
@@ -157,6 +157,8 @@ of the parameters you can copy / paste in that configuration module: ::
 
     # Flask-WTF flag for CSRF
     WTF_CSRF_ENABLED = True
+    # Add endpoints that need to be exempt from CSRF protection
+    WTF_CSRF_EXEMPT_LIST = []
 
     # Set this API key to enable Mapbox visualizations
     MAPBOX_API_KEY = ''
@@ -172,6 +174,11 @@ Please make sure to change:
 * *SQLALCHEMY_DATABASE_URI*, by default it is stored at *~/.superset/superset.db*
 * *SECRET_KEY*, to a long random string
 
+In case you need to exempt endpoints from CSRF, e.g. you are running a custom
+auth postback endpoint, you can add them to *WTF_CSRF_EXEMPT_LIST*
+
+     WTF_CSRF_EXEMPT_LIST = ['']
+
 Database dependencies
 ---------------------
 
diff --git a/superset/__init__.py b/superset/__init__.py
index 2e44ebd..af81248 100644
--- a/superset/__init__.py
+++ b/superset/__init__.py
@@ -83,6 +83,9 @@ db = SQLA(app)
 
 if conf.get('WTF_CSRF_ENABLED'):
     csrf = CSRFProtect(app)
+    csrf_exempt_list = conf.get('WTF_CSRF_EXEMPT_LIST', [])
+    for ex in csrf_exempt_list:
+        csrf.exempt(ex)
 
 utils.pessimistic_connection_handling(db.engine)
 
diff --git a/superset/config.py b/superset/config.py
index 0cbf7d3..d4c019c 100644
--- a/superset/config.py
+++ b/superset/config.py
@@ -75,6 +75,9 @@ QUERY_SEARCH_LIMIT = 1000
 # Flask-WTF flag for CSRF
 WTF_CSRF_ENABLED = True
 
+# Add endpoints that need to be exempt from CSRF protection
+WTF_CSRF_EXEMPT_LIST = []
+
 # Whether to run the web server in debug mode or not
 DEBUG = False
 FLASK_USE_RELOAD = True

-- 
To stop receiving notification emails like this one, please contact
['"commits@superset.apache.org" <co...@superset.apache.org>'].