mikebridge commented on code in PR #45550: URL: https://github.com/apache/superset/pull/45550#discussion_r4364822892
########## UPDATING.md: ########## @@ -36,6 +36,20 @@ assists people when migrating to a new version. them, with suggestions for supported fields. Use `created_by_me` for authorship or `edited_by_me` for direct user ownership where supported, not `owned_by_me`. +- The extension storage write routes (`PUT`/`DELETE` under + `/api/v1/extensions/<publisher>/<name>/storage/`) are no longer exempt from + CSRF protection. They inherited the exemption from Flask-AppBuilder's + `BaseApi`; they now behave like every other Superset REST API that is not in + `WTF_CSRF_EXEMPT_LIST`. The browser already sends the token. Any other client + that writes extension storage, whether it authenticates with a session + cookie, a JWT bearer token or an API key, must first call + `GET /api/v1/security/csrf_token/` with its credential, then send the Review Comment: _AI-assisted reply on Mike's behalf._ Good catch, thanks. Added in f2a7a2714b: the note now says the client's role also needs `can_read` on `SecurityRestApi` (shown as "can read on SecurityRestApi" in the role editor) to fetch the token, so a role that only had the extension storage permissions knows what to add. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
