sfirke opened a new pull request, #45635:
URL: https://github.com/apache/superset/pull/45635
### SUMMARY
The security docs tell operators to set `SESSION_USE_SIGNER = True` when
enabling server-side sessions. That option has been deprecated since
Flask-Session 0.6, and Superset has pinned Flask-Session 0.8.0 since #27751
(4.1.0), where setting it logs a `DeprecationWarning` at startup:
> The 'use_signer' option is deprecated and will be removed in the next
minor release.
With server-side sessions the cookie carries only a random 32-character
session ID, so there is nothing for a signer to protect. The existing comment
("Ensure the session cookie is signed for integrity") was misleading on that
point as well. This PR removes the setting from every docs version that ships
Flask-Session 0.8.0, which is all of them.
While doing that I noticed the "Security Configurations" reference page and
the "Securing Your Superset Installation for Production" hardening guide each
carried their own Redis `superset_config.py` example, and the two had already
drifted (one bare `Redis(host="redis", ...)`, the other with env vars,
password, and TLS). This PR keeps the production-grade example on the hardening
page, which is what operators copy from, and replaces the reference page's
snippet with a link to it so there is one example to maintain.
Changes by file:
- `docs/admin_docs/security/securing_superset.mdx` and its 6.1.0 versioned
copy: remove the `SESSION_USE_SIGNER` line and its comment from the Redis
example.
- `docs/admin_docs/security/security.mdx` and its 6.1.0 versioned copy: keep
the conceptual explanation and `SESSION_SERVER_SIDE = True`; replace the Redis
snippet with a link to the hardening guide's example.
- `docs/user_docs_versioned_docs/version-6.0.0/security/security.mdx`:
remove the `SESSION_USE_SIGNER` line only. That version has no hardening page
to point to, so its example stays.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A, docs only.
### TESTING INSTRUCTIONS
1. `cd docs && yarn start`, then open the two security pages under Admin
Docs and confirm the Redis example on the hardening page no longer mentions
`SESSION_USE_SIGNER`, and the reference page's server-side session section
links to it.
2. Confirm the link resolves on the 6.1.0 versioned docs as well.
3. Optional sanity check that the config in the hardening page is still
valid: enable server-side sessions with the example config on a 6.1.0 or master
instance and confirm login/logout work and no `DeprecationWarning` about
`use_signer` appears in the logs.
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
---
🤖 _Drafted by Claude Code, reviewed and approved by @sfirke._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
