-
Notifications
You must be signed in to change notification settings - Fork 13.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore: support different JWT CSRF cookie names #25891
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
|
||
function getDefaultConfiguration(): ClientConfig { | ||
const csrfNode = document.querySelector<HTMLInputElement>('#csrf_token'); | ||
const csrfToken = csrfNode?.value; | ||
|
||
// when using flask-jwt-extended csrf is set in cookies | ||
const cookieCSRFToken = parseCookie().csrf_access_token || ''; | ||
const jwtAccessCsrfCookieName = | ||
bootstrapData.common.conf.JWT_ACCESS_CSRF_COOKIE_NAME; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Shouldn't we have a fallback here to 'csrf_access_token'
?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
by default JWT_ACCESS_CSRF_COOKIE_NAME
is csrf_access_token
and that default is set by flask-jwt-extended
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
SUMMARY
Currently
SupersetClient
only supports flask-jwt-extended default access CSRF cookie name, yet this name can be set using JWT_ACCESS_CSRF_COOKIE_NAME.This PR makes
SupersetClient
support this configBEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
TESTING INSTRUCTIONS
ADDITIONAL INFORMATION