aminghadersohi commented on PR #43606: URL: https://github.com/apache/superset/pull/43606#issuecomment-5485726226
Good point — I agree that signing did not provide meaningful provenance here because the anonymous endpoint would mint a token for any safe same-host destination, and the expiry worked against the stale-tab case. I simplified this to a plain `login_redirect=1` entry-point flag, retained `get_safe_redirect()` and the backslash validation, and kept the index fallback for unflagged authenticated requests. I also updated the tests and PR description. Thanks for calling this out! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
