GitHub user geovanasullivan added a comment to the discussion: 403 Forbidden on 
embedded dashboard in production (worked fine in test), missing can read on 
CurrentUserRestApi permission?

@dosu 

Update: I ran a manual test that narrowed this down significantly.

I executed the exact same login call (POST /api/v1/security/login) manually via 
curl from an external machine (not our production server), and it succeeded — 
returned a valid access_token and refresh_token. This confirms:

The app-wooall credentials are correct
The account is not locked/disabled
There's no simple firewall/IP block preventing external access to the Superset 
instance in general

However, our .NET backend (ASP.NET Core, using HttpClient inside an async 
Controller method) still fails with a raw 403 Forbidden response — no JSON 
body, just the plain text "Forbidden". This is different from a typical 
Superset-generated auth error, which usually returns a JSON error message.

I noticed the Superset instance is behind Cloudflare (Server: cloudflare in 
response headers). My working theory is that HttpClient in .NET does not send a 
User-Agent header by default, and Cloudflare's bot protection may be blocking 
requests that lack one — which would explain why curl (which always sends a 
User-Agent) succeeds while the .NET backend doesn't.

My questions:

Does Superset (or a Cloudflare layer in front of it) have any default 
WAF/bot-protection rules that specifically block requests missing a User-Agent 
header, or with generic/empty ones?
Is there a way to check Cloudflare-level firewall/WAF logs (separate from 
Superset's own action_log) to see if these specific requests are being blocked 
before they even reach Superset's application layer?
Besides User-Agent, are there other headers commonly required by Cloudflare/WAF 
rules that a plain server-to-server HTTP client might be missing compared to a 
browser or curl?

For context: the same credentials, same Superset instance, same endpoint — only 
difference is the origin/client making the call (external curl vs. our .NET 
production backend). Any guidance on where to check next (Cloudflare dashboard, 
Superset logs, or something else) would be appreciated.

GitHub link: 
https://github.com/apache/superset/discussions/42547#discussioncomment-17828993

----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to: 
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to