fix(docs): allow *.run.app in CSP for the Kapa widget backend#42276
Merged
Conversation
The Kapa widget on superset.apache.org calls a backend hosted on Google Cloud Run (*.run.app), which the site CSP blocks, breaking the widget. Add the domain to CSP_PROJECT_DOMAINS with a note that it is a Google-owned domain gated behind explicit user acceptance when opening the widget, per ASF privacy policy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Code Review Agent Run #50340fActionable Suggestions - 0Review Details
Bito Usage GuideCommands Type the following command in the pull request comment and save the comment.
Refer to the documentation for additional commands. Configuration This repository uses Documentation & Help AI Code Review powered by |
✅ Deploy Preview for superset-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
sadpandajoe
approved these changes
Jul 21, 2026
sadpandajoe
added
review:checkpoint
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SUMMARY
The Kapa widget on superset.apache.org calls a backend hosted on Google Cloud Run (
*.run.app), which the site's CSP currently blocks, so the widget doesn't work. This addshttps://*.run.app/toCSP_PROJECT_DOMAINSindocs/static/.htaccess(the ASF-infra CSP mechanism, see https://infra.apache.org/tools/csp.html).Per the comment added alongside the other entries:
*.run.appis a Google-owned domain, and it's only reached after explicit user acceptance when opening the Kapa widget, which keeps it allowable under the ASF privacy policy (https://privacy.apache.org/faq/committers.html), same as the existing*.google.com/*.gstatic.comentries.BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A (CSP header change on the docs site)
TESTING INSTRUCTIONS
After this deploys to superset.apache.org, open the Kapa "Ask AI" widget, accept the consent prompt, and confirm the chat works with no CSP violations for
*.run.appin the browser console.ADDITIONAL INFORMATION
🤖 Generated with Claude Code