bikash-barnwal opened a new pull request, #43185: URL: https://github.com/apache/superset/pull/43185
### SUMMARY Superset sets `SEND_FILE_MAX_AGE_DEFAULT` to 365 days for static assets (`config.py:2846`), and Flask stamps that on **every** `send_file` response that doesn't opt out. The export endpoints build their ZIP with `send_file`, so an export of live metadata went out as: ``` Cache-Control: public, max-age=31536000 ``` (verified locally against an unpatched `send_file` on the export path), leaving browsers and intermediate proxies serving a stale archive. The response construction moves into a shared `send_export_zip` helper that passes `max_age=0` and marks the response `no-store`, `no-cache`, `must-revalidate`. It is used from all seven export endpoints — chart, dashboard, database, dataset, saved query, theme and importexport — which also folds seven copies of the same `send_file` + token-cookie block into one place (net −29 lines). The existing `token` query-parameter cookie behavior, including its `sanitize_cookie_token` guard, is preserved exactly. Caching of genuine static assets is untouched: only the export responses opt out. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF | | `Cache-Control` on an export download | |---|---| | before | `public, max-age=31536000` | | after | `no-store, no-cache, must-revalidate, max-age=0` | ### TESTING INSTRUCTIONS ```bash pytest tests/unit_tests/utils/send_export_zip_tests.py pytest tests/unit_tests/ -k export ``` New unit tests cover the cache headers, the attachment name and mimetype, the download-token cookie, and that an unsafe token is still rejected. Locally: 4 passed for the new file, and **180 passed / 1 skipped** across the export-related unit tests. Manually: export any dashboard or chart and inspect the response headers in devtools; re-export after changing the object and confirm the new archive is fetched rather than served from cache. ### ADDITIONAL INFORMATION - [x] Has associated issue: Fixes #41687 - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
