GitHub user FrancescoCastaldi added a comment to the discussion: Show friendly
error when Superset unable to connect to backing database
Exposing database credentials, hostnames, and raw psycopg2 stack traces to
dashboard viewers presents both a UX problem and a security risk.
In Apache Superset, you can sanitize these error messages and replace them with
a friendly generic notification using the following mechanisms:
### 1. Disable Detailed Stacktraces in Production
Ensure that `SHOW_STACKTRACE` is disabled in `superset_config.py`:
```python
# In superset_config.py
SHOW_STACKTRACE = False
```
When set to `False`, Superset suppresses raw Python exception tracebacks for
non-administrative users.
### 2. Custom Error Extraction in `superset_config.py`
Superset's database engine specs use the `extract_errors` classmethod to
translate driver exceptions into structured `SupersetError` objects
(`superset/db_engine_specs/base.py`). You can intercept PostgreSQL operational
errors in `superset_config.py`:
```python
# In superset_config.py
from superset.db_engine_specs.postgres import PostgresEngineSpec
from superset.errors import SupersetError, SupersetErrorType, ErrorLevel
_original_extract_errors = PostgresEngineSpec.extract_errors
def custom_postgres_extract_errors(cls, ex, context=None):
error_str = str(ex)
if "OperationalError" in error_str or "password authentication failed" in
error_str or "connection to server at" in error_str:
return [
SupersetError(
message="Unable to connect to the analytical database. Please
verify network access or contact your administrator.",
error_type=SupersetErrorType.GENERIC_DB_ENGINE_ERROR,
level=ErrorLevel.ERROR,
extra={"issue_codes": [{"code": 1011, "message": "Connection
failure"}]},
)
]
return _original_extract_errors(ex, context)
PostgresEngineSpec.extract_errors = classmethod(custom_postgres_extract_errors)
```
### 3. Database Connection Security Masking
In **Settings -> Database Connections -> Edit Database -> Advanced ->
Security**:
- Check **Mask Sensitive Information**.
- This ensures that connection strings, hostnames, and usernames are masked
across the Explore UI and API error payloads.
GitHub link:
https://github.com/apache/superset/discussions/40881#discussioncomment-19164798
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
