codeant-ai-for-open-source[bot] commented on code in PR #43600:
URL: https://github.com/apache/superset/pull/43600#discussion_r3873596759
##########
docs/docs/using-superset/embedding.mdx:
##########
@@ -88,6 +88,19 @@ embedDashboard({
If the callback returns `null` or is not provided, Superset uses its own
permalink URL as a fallback.
+### Permalink origin rewriting
+
+Separately from `resolvePermalinkUrl`, Superset itself rewrites the origin of
any permalink URL it generates to `window.location.origin` before showing it to
the user. This keeps a proxied or subdirectory-deployed Superset from handing
out a permalink that points at an internal hostname the user's browser can't
reach.
+
Review Comment:
**Suggestion:** The implementation does not rewrite every permalink in
embedded mode: a custom `resolvePermalinkUrl` result is returned unchanged, and
when no callback is available the backend URL is also returned unchanged.
Narrow this description to non-embedded fallback URLs or explicitly document
the embedded-mode exceptions. [api mismatch]
<details>
<summary><b>Severity Level:</b> Minor ๐งน</summary>
```mdx
- โ ๏ธ Embedded callback URLs bypass Superset origin rewriting.
- โ ๏ธ Embedded fallback URLs retain the backend-supplied origin.
- โ ๏ธ Documentation can lead embed operators to expect rewriting that does
not occur.
```
</details>
[](https://docs.codeant.ai/cli/resolve-pr-comments-skill)
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=fd9294f43b784fa8aa96be77536b1c70&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=fd9294f43b784fa8aa96be77536b1c70&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
<details>
<summary><b>Prompt for AI Agent ๐ค </b></summary>
```mdx
This is a comment left during a code review.
**Path:** docs/docs/using-superset/embedding.mdx
**Line:** 93:94
**Comment:**
*Api Mismatch: The implementation does not rewrite every permalink in
embedded mode: a custom `resolvePermalinkUrl` result is returned unchanged, and
when no callback is available the backend URL is also returned unchanged.
Narrow this description to non-embedded fallback URLs or explicitly document
the embedded-mode exceptions.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43600&comment_hash=fcae827ab7d80716b993297f22d552405f30db1024b4b06b954a1dd409ef6df2&reaction=like'>๐</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43600&comment_hash=fcae827ab7d80716b993297f22d552405f30db1024b4b06b954a1dd409ef6df2&reaction=dislike'>๐</a>
##########
docs/docs/using-superset/embedding.mdx:
##########
@@ -88,6 +88,19 @@ embedDashboard({
If the callback returns `null` or is not provided, Superset uses its own
permalink URL as a fallback.
+### Permalink origin rewriting
+
+Separately from `resolvePermalinkUrl`, Superset itself rewrites the origin of
any permalink URL it generates to `window.location.origin` before showing it to
the user. This keeps a proxied or subdirectory-deployed Superset from handing
out a permalink that points at an internal hostname the user's browser can't
reach.
+
+If your reverse proxy correctly forwards `X-Forwarded-Host` and you'd rather
permalinks carry the backend's literal origin, opt out of the rewrite with
`EMBEDDED_DISABLE_PERMALINK_ORIGIN_REWRITE`:
+
+```python
+# superset_config.py
+EMBEDDED_DISABLE_PERMALINK_ORIGIN_REWRITE = True
+```
Review Comment:
**Suggestion:** This flag is not an embedded-only opt-out. The frontend
consults it only in the non-embedded permalink path, while embedded permalinks
already bypass origin rewriting regardless of the flag; enabling it therefore
changes ordinary Superset permalink behavior as well. Document its actual
global scope and clarify that it has no effect on embedded callback or fallback
URLs. [api mismatch]
<details>
<summary><b>Severity Level:</b> Minor ๐งน</summary>
```mdx
- โ ๏ธ Flag changes ordinary non-embedded permalink origins.
- โ ๏ธ Flag does not alter embedded callback URLs.
- โ ๏ธ Flag does not alter embedded fallback URLs.
```
</details>
[](https://docs.codeant.ai/cli/resolve-pr-comments-skill)
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=6abd4ecdae2c4f10ab021c1c543633e1&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=6abd4ecdae2c4f10ab021c1c543633e1&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
<details>
<summary><b>Prompt for AI Agent ๐ค </b></summary>
```mdx
This is a comment left during a code review.
**Path:** docs/docs/using-superset/embedding.mdx
**Line:** 95:100
**Comment:**
*Api Mismatch: This flag is not an embedded-only opt-out. The frontend
consults it only in the non-embedded permalink path, while embedded permalinks
already bypass origin rewriting regardless of the flag; enabling it therefore
changes ordinary Superset permalink behavior as well. Document its actual
global scope and clarify that it has no effect on embedded callback or fallback
URLs.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43600&comment_hash=816f258f2eed281ef98b289ac5aec5fe4926fa7d476b10a94f18fa502da85cf9&reaction=like'>๐</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43600&comment_hash=816f258f2eed281ef98b289ac5aec5fe4926fa7d476b10a94f18fa502da85cf9&reaction=dislike'>๐</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
