GitHub user geovanasullivan added a comment to the discussion: 403 Forbidden on embedded dashboard in production (worked fine in test), missing can read on CurrentUserRestApi permission?
@dosu Update: I ran a manual test that narrowed this down significantly. I executed the exact same login call (POST /api/v1/security/login) manually via curl from an external machine (not our production server), and it succeeded — returned a valid access_token and refresh_token. This confirms: The app-wooall credentials are correct The account is not locked/disabled There's no simple firewall/IP block preventing external access to the Superset instance in general However, our .NET backend (ASP.NET Core, using HttpClient inside an async Controller method) still fails with a raw 403 Forbidden response — no JSON body, just the plain text "Forbidden". This is different from a typical Superset-generated auth error, which usually returns a JSON error message. I noticed the Superset instance is behind Cloudflare (Server: cloudflare in response headers). My working theory is that HttpClient in .NET does not send a User-Agent header by default, and Cloudflare's bot protection may be blocking requests that lack one — which would explain why curl (which always sends a User-Agent) succeeds while the .NET backend doesn't. My questions: Does Superset (or a Cloudflare layer in front of it) have any default WAF/bot-protection rules that specifically block requests missing a User-Agent header, or with generic/empty ones? Is there a way to check Cloudflare-level firewall/WAF logs (separate from Superset's own action_log) to see if these specific requests are being blocked before they even reach Superset's application layer? Besides User-Agent, are there other headers commonly required by Cloudflare/WAF rules that a plain server-to-server HTTP client might be missing compared to a browser or curl? For context: the same credentials, same Superset instance, same endpoint — only difference is the origin/client making the call (external curl vs. our .NET production backend). Any guidance on where to check next (Cloudflare dashboard, Superset logs, or something else) would be appreciated. GitHub link: https://github.com/apache/superset/discussions/42547#discussioncomment-17828993 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
