Issues embedding dashboard in public website

[RealTun]

Bug description

i'm using superset via

docker compose -f docker-compose-non-dev.yml up -d

I tried add to superset_config.py:

TALISMAN=False
HTTP_HEADERS = {'X-Frame-Options': 'ALLOWALL'}
PUBLIC_ROLE_LIKE = "Gamma"

So i get error:

Refused to display 'http://localhost:8088/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

Screenshots/recordings

No response

Superset version

master / latest-dev

Python version

3.9

Node version

16

Browser

Chrome

Additional context

No response

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot[bot]]

Hey @RealTun, I'm here to assist you with the issue you're facing in embedding the Superset dashboard. I can help you with bug fixes, answering questions, and even guide you on how to become a contributor. Let's tackle this together!

I found some similar discussions that might help you resolve the issue with embedding a Superset dashboard in a public website:

1. Embed charts with iframe without any login - This discussion suggests configuring Talisman in the config.py file to allow embedding by setting frame_options to 'ALLOWALL' and frame_options_allow_from to '*'.

2. Not able to embed superset in iframe - This discussion also deals with iframe embedding issues.

To resolve the 'X-Frame-Options' error, you should modify the superset_config.py file to adjust the Content Security Policy (CSP) settings using flask-talisman. Specifically, configure the frame-ancestors directive to allow your domain:

TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
    "content_security_policy": {
        "frame-ancestors": ["*.my-domain.com", "*.another-domain.com"],
    }
}

After making these changes, restart Superset to apply the new configuration ^[1].

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Other}

[RealTun]

@dosu i added:
TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
"content_security_policy": {
"frame-ancestors": [".127.0.0.1:5500", ".localhost:3000"],
}
}

but i still get same error

[dosubot[bot]]

Ensure that the TALISMAN_CONFIG is correctly set in your superset_config.py file and that Superset is restarted after making these changes. Additionally, verify that the X-Frame-Options header is not being set elsewhere in your configuration or by any reverse proxy or web server in front of Superset.

If the issue persists, you might want to explicitly set the X-Frame-Options header to ALLOWALL in the HTTP_HEADERS configuration:

HTTP_HEADERS = {
    'X-Frame-Options': 'ALLOWALL'
}

Make sure that TALISMAN_ENABLED is set to True and that there are no conflicting settings in your environment. After making these changes, restart Superset to ensure the new settings take effect.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Other}

[RealTun]

@dosu i added it, sill get same error

TALISMAN_ENABLED = True
TALISMAN_CONFIG = {
    "content_security_policy": {
        "frame-ancestors": ["*.127.0.0.1:5500", "*.localhost:3000"],
    }
}
HTTP_HEADERS = {
    'X-Frame-Options': 'ALLOWALL'
}

[dosubot[bot]]

To resolve the 'X-Frame-Options' error when embedding a Superset dashboard, ensure that your superset_config.py is correctly configured and that no other settings or middleware are overriding your configurations. Here are some steps to consider:

1. Check for Conflicting Headers: Ensure that no reverse proxy or web server in front of Superset is setting the X-Frame-Options header to sameorigin. This can override your Superset settings.

2. Restart Superset: After making changes to superset_config.py, make sure to restart Superset to apply the new configuration.

3. Verify Domain Configuration: Double-check that the domains specified in frame-ancestors are correct and match the domains from which you are trying to embed the dashboard.

4. Public Access: Ensure that the dashboard is publicly accessible. You might need to enable the 'DASHBOARD_RBAC': True feature flag and assign the Public role to the dashboard to allow access without authentication.

If these steps do not resolve the issue, consider reviewing any additional configurations or middleware that might be affecting the headers.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Other}

[dosubot[bot]]

Ensure that there are no other configurations or middleware that might be overriding your settings. Here are a few steps to troubleshoot further:

1. Check for Conflicts: Make sure there are no other settings or middleware (like a reverse proxy) that might be setting the X-Frame-Options header to sameorigin.

2. Order of Configuration: Ensure that the TALISMAN_CONFIG and HTTP_HEADERS are correctly placed in your superset_config.py and that there are no other conflicting configurations.

3. Restart Superset: After making changes to the configuration, restart your Superset instance to apply the new settings.

4. Browser Cache: Clear your browser cache or try accessing the site in an incognito window to ensure you're not seeing cached headers.

5. Inspect Headers: Use browser developer tools to inspect the response headers and confirm what X-Frame-Options is being set to. This can help identify if the header is being set elsewhere.

If these steps don't resolve the issue, consider checking any web server or proxy configurations that might be affecting the headers.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Other}

[yonatan-quintero]

If you are using a reverse proxy like Ngnix try to add the header:

add_header Content-Security-Policy "frame-ancestors 'self' http://localhost:3501 https://myotherdomain.com";

[rusackas]

You probably shouldn't be using docker compose for production servers. @sfirke might be able to help with some of this. Meanwhile, I'll convert this to a Discussion since it's not a bug.

[sfirke]

Here are some steps for this: https://superset.apache.org/docs/configuration/networking-settings/#embedding-a-public-direct-link-to-a-dashboard

Start there and if that doesn't do it, maybe we can expand those docs?

[mateusht-ciandt]

Is there any way or documentation showing how to deploy superset under a prefixed URL (https://myhost.com/my-superset) avoiding redirect issues? I would like to use embedding dashboard as well but under Azure APIM.

[hmendezm]

Hi guys, I have this issue as well, and I did all the changes on Talismand and the header. I have version 5.0.0. Did someone find the solution to this issue?
I appreaciate any help!
Best
H. Mendez

[RealTun]

You need grant permission access to database that u wanting other people can see for public.
Watch this video from 4m20s: https://youtu.be/FH_2csQ7D9c?si=7XETUEv1_QKgsdu-&t=269