sadpandajoe commented on code in PR #45550:
URL: https://github.com/apache/superset/pull/45550#discussion_r4364771598
##########
UPDATING.md:
##########
@@ -36,6 +36,20 @@ assists people when migrating to a new version.
them, with suggestions for supported fields. Use `created_by_me` for
authorship
or `edited_by_me` for direct user ownership where supported, not
`owned_by_me`.
+- The extension storage write routes (`PUT`/`DELETE` under
+ `/api/v1/extensions/<publisher>/<name>/storage/`) are no longer exempt from
+ CSRF protection. They inherited the exemption from Flask-AppBuilder's
+ `BaseApi`; they now behave like every other Superset REST API that is not in
+ `WTF_CSRF_EXEMPT_LIST`. The browser already sends the token. Any other client
+ that writes extension storage, whether it authenticates with a session
+ cookie, a JWT bearer token or an API key, must first call
+ `GET /api/v1/security/csrf_token/` with its credential, then send the
Review Comment:
A scripted client that was granted only the extension storage permissions
(for example `can_set_persistent` on `ExtensionStorageRestApi`) could write
before this change. Following these steps now, its `GET
/api/v1/security/csrf_token/` call returns 403, because that endpoint is
`@protect()` with `@permission_name("read")` on `SecurityRestApi`, so the
writes stay blocked. Should this note also say such roles need `can_read` on
`SecurityRestApi`?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
