alionar commented on issue #43550: URL: https://github.com/apache/superset/issues/43550#issuecomment-5435531553
Hi @rusackas Thanks for checking. I already reproduce this on current master branch at commit `686245a905a60d8ea49b84afacfd6977a65cb5ed`. Test config: `python WTF_CSRF_TIME_LIMIT = 5 ` After logging in, I opened the dataset editor, waited for 5 seconds, modified the setting, and saved the dataset. The dataset request failed: <img width="3812" height="2484" alt="Image" src="https://github.com/user-attachments/assets/d4247c16-b9df-4d59-bda2-71b5c1004e03"; /> Compared with the 4.0.2 incident, current `master` displays the underlying message, `The CSRF token has expired`. However, the dialog still labels the failure as a database engine error. This misclassification can confuse users, and they remain blocked until they reload the page and repeat the save. <img width="1490" height="540" alt="Image" src="https://github.com/user-attachments/assets/792aa9aa-2633-4cff-8933-c776e9ffad9c"; /> I understand why JSON requests are not redirected, since the same API endpoints may be used by both the Superset UI and external clients. Is there an established Superset pattern for handling UI-originated requests differently, so the UI can refresh the CSRF token and retry automatically? If the session has expired, it could redirect to login; if recovery fails, it could prompt the user to reload. External API clients would continue receiving a structured JSON error. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
