mirror of
https://github.com/apache/superset.git
synced 2024-09-12 08:39:45 -04:00
[security] allowing to set static headers as configuration (#1126)
* [security] setting X-Frame-Options=SAMEORIGIN to prevent clickjacking * Changing to a more flexible approach
This commit is contained in:
parent
f1e80a8e1b
commit
b5875764ed
@ -220,6 +220,12 @@ CELERY_CONFIG = None
|
|||||||
SQL_CELERY_DB_FILE_PATH = os.path.join(DATA_DIR, 'celerydb.sqlite')
|
SQL_CELERY_DB_FILE_PATH = os.path.join(DATA_DIR, 'celerydb.sqlite')
|
||||||
SQL_CELERY_RESULTS_DB_FILE_PATH = os.path.join(DATA_DIR, 'celery_results.sqlite')
|
SQL_CELERY_RESULTS_DB_FILE_PATH = os.path.join(DATA_DIR, 'celery_results.sqlite')
|
||||||
|
|
||||||
|
# static http headers to be served by your Caravel server.
|
||||||
|
# The following example prevents iFrame from other domains
|
||||||
|
# and "clickjacking" as a result
|
||||||
|
# HTTP_HEADERS = {'X-Frame-Options': 'SAMEORIGIN'}
|
||||||
|
HTTP_HEADERS = {}
|
||||||
|
|
||||||
# The db id here results in selecting this one as a default in SQL Lab
|
# The db id here results in selecting this one as a default in SQL Lab
|
||||||
DEFAULT_DB_ID = None
|
DEFAULT_DB_ID = None
|
||||||
|
|
||||||
|
@ -1796,6 +1796,14 @@ appbuilder.add_link(
|
|||||||
icon="fa-flask")
|
icon="fa-flask")
|
||||||
|
|
||||||
|
|
||||||
|
@app.after_request
|
||||||
|
def apply_caching(response):
|
||||||
|
"""Applies the configuration's http headers to all responses"""
|
||||||
|
for k, v in config.get('HTTP_HEADERS').items():
|
||||||
|
response.headers[k] = v
|
||||||
|
return response
|
||||||
|
|
||||||
|
|
||||||
# ---------------------------------------------------------------------
|
# ---------------------------------------------------------------------
|
||||||
# Redirecting URL from previous names
|
# Redirecting URL from previous names
|
||||||
class RegexConverter(BaseConverter):
|
class RegexConverter(BaseConverter):
|
||||||
|
Loading…
Reference in New Issue
Block a user