Adding an image into a dashboard

[luan-beserra]

I just can't add an image to a dashboard. I have tried using both Markdown and HTML tags with the image URL on the web and it didn't work, this is the error loading the page: Loading the image 'https://i.ibb.co/JwDzM4dB/Logo-Pref-Diadema-com-Frase.png' violates the following Content Security Policy directive: "img-src 'self' blob: data: https://apachesuperset.gateway.scarf.sh https://static.scarf.sh/ https://cdn.brandfolder.io ows.terrestris.de https://cdn.document360.io". The action has been blocked.

And I have tried to paste the image into the \superset-frontend\src\assets\images directory but the image also don't appear as it should

I am using version: 6.1.0

[dosubot[bot]]

Hi @luan-beserra! I'm Dosu and I'm helping the Apache Superset team.

The error you're seeing is a Content Security Policy (CSP) violation. Superset's CSP restricts which domains images can be loaded from via the img-src directive. By default, only 'self', blob:, data:, and a few specific CDNs are allowed [1].

To load images from i.ibb.co (or any external URL), you need to add that domain to the img-src list in your TALISMAN_CONFIG inside your superset_config.py file. For example:

TALISMAN_CONFIG = {
    "content_security_policy": {
        "default-src": ["'self'"],
        "img-src": [
            "'self'",
            "blob:",
            "data:",
            "https://i.ibb.co",  # <-- add your image host here
        ],
        # ... keep other directives as needed
    },
    "content_security_policy_nonce_in": ["script-src"],
    "force_https": False,
}

Make sure TALISMAN_ENABLED = True is also set if you're providing a custom config [1]. You can copy the full default TALISMAN_CONFIG from superset/config.py and just add "https://i.ibb.co" to the img-src list to keep all the other defaults intact.

After updating, restart Superset for the changes to take effect. Then you should be able to use a Markdown component on your dashboard with ![Logo](https://i.ibb.co/JwDzM4dB/Logo-Pref-Diadema-com-Frase.png) and the image will load.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[luan-beserra]

I'm getting the same error. Maybe the import is not correct: from flask_talisman import Talisman

[dosubot[bot]]

You don't need to import flask_talisman in your superset_config.py — Superset handles that internally in its own extensions module [1]. You just set plain Python variables in your config file.

Here's what your superset_config.py should look like (no imports needed):

TALISMAN_ENABLED = True

TALISMAN_CONFIG = {
    "content_security_policy": {
        "base-uri": ["'self'"],
        "default-src": ["'self'"],
        "img-src": [
            "'self'",
            "blob:",
            "data:",
            "https://apachesuperset.gateway.scarf.sh",
            "https://static.scarf.sh/",
            "https://cdn.document360.io",
            "ows.terrestris.de",
            "https://i.ibb.co",  # your image host
        ],
        "worker-src": ["'self'", "blob:"],
        "connect-src": [
            "'self'",
            "https://api.mapbox.com",
            "https://events.mapbox.com",
        ],
        "object-src": "'none'",
        "style-src": ["'self'", "'unsafe-inline'"],
        "script-src": ["'self'", "'strict-dynamic'"],
    },
    "content_security_policy_nonce_in": ["script-src"],
    "force_https": False,
    "session_cookie_secure": False,
}

The full dictionary replaces the default, so make sure you copy all the directives (not just img-src) [2]. After saving, restart Superset and the image should load in your Markdown component.

Also note: if TALISMAN_ENABLED was previously False (which is the default) [3], the CSP you're seeing in the error might be coming from something else — like a reverse proxy (nginx, etc.) or a Docker image configuration injecting its own CSP headers. Worth checking that as well if the config change alone doesn't resolve it.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[luan-beserra]

still the same error message. what I could do to check it: Also note: if TALISMAN_ENABLED was previously False (which is the default) [3], the CSP you're seeing in the error might be coming from something else — like a reverse proxy (nginx, etc.) or a Docker image configuration injecting its own CSP headers. Worth checking that as well if the config change alone doesn't resolve it.

[dosubot[bot]]

Since the error persists, the most likely issue is that your superset_config.py isn't being picked up, or an environment variable is overriding it. The CSP in your error message matches the default TALISMAN_CONFIG exactly [1], which means your custom config isn't taking effect. Here's how to diagnose:

1. Check if your config file is actually loaded. Verify the SUPERSET_CONFIG_PATH environment variable points to the right file:

docker exec <container-name> env | grep SUPERSET_CONFIG_PATH

2. Check if an environment variable is force-enabling Talisman:

docker exec <container-name> env | grep -i TALISMAN

3. Inspect the running config directly to see what Superset is actually using:

docker exec -it <container-name> superset shell

Then in the Python shell:

from flask import current_app
print(current_app.config.get("TALISMAN_ENABLED"))
print(current_app.config.get("TALISMAN_CONFIG"))

4. Check if you're running in debug mode. If so, Superset uses TALISMAN_DEV_CONFIG instead of TALISMAN_CONFIG [2]. You'd need to override TALISMAN_DEV_CONFIG as well.

5. Check browser response headers. In your browser DevTools → Network tab, click any request to Superset and look at the Content-Security-Policy response header. This confirms where the CSP is actually coming from. If the header isn't present in the response, the CSP might be enforced by a browser extension or another layer.

The nginx included in Superset's Docker setup does not set any CSP headers [3], so Flask-Talisman is the only source within Superset itself.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[PARKER-X]

@dosu I am getting error- Evaluating a string as JavaScript violates the following Content Security Policy directive because 'unsafe-eval' is not an allowed source of script: script-src 'self' 'strict-dynamic' 'nonce-D7tdvZDbLkjXJesp1m4Ftbme0-jZycnq'".
I am using apache superset 6 version latest