sadpandajoe commented on code in PR #45404:
URL: https://github.com/apache/superset/pull/45404#discussion_r4410071145
##########
superset-frontend/src/middleware/realtime.ts:
##########
@@ -267,16 +301,132 @@ const teardownSocket = (): void => {
}
};
+interface Ticket {
+ token: string;
+ expiresInMs: number;
+}
+
+/** Fetch a fresh connection ticket for the current session. */
+const fetchTicket = async (): Promise<Ticket> => {
+ const { json } = await SupersetClient.get({ endpoint: TICKET_ENDPOINT });
Review Comment:
For an anonymous visitor on a public dashboard (`PUBLIC_ROLE_LIKE` set with
`WEBSOCKET_ENABLE` on), the bootstrap still enables realtime, so this ticket
request returns 401. Since it doesn't pass `ignoreUnauthorized: true`,
`SupersetClient` runs its unauthorized handler and navigates to `/login` before
`isUnauthorizedError` here ever sees the rejection, so opening the dashboard
bounces the visitor to the login page instead of just leaving realtime off.
Should this request pass `ignoreUnauthorized: true`, or skip the ticket fetch
when there is no signed-in user?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
