cannot post a new DB to apache-superset, 400 Error with CSRF

Question

I am unsure how I can set the CSRF token so apache superset is happy.. here is my code

Create a DB Connection for Apache Superset

import requests
import json

base_url = "http://SOMEIP:8088/"

login_url = base_url + "api/v1/security/login"
csrf_url = base_url + "api/v1/security/csrf_token"


def create_db_connection(session, db_ip, db_port, db_user, db_pass, db_name):

    url = base_url + "api/v1/database/"

    sqlalchemy_url = "postgresql://" + db_user + ":" + db_pass + "@" + db_ip + ":" + str(db_port)+"/" + db_name

    data_out = {
      "allow_csv_upload": True,
      "allow_ctas": True,
      "allow_cvas": True,
      "allow_dml": True,
      "allow_multi_schema_metadata_fetch": True,
      "allow_run_async": True,
      "cache_timeout": 0,
      "database_name": db_name,
      "expose_in_sqllab": True,
      "impersonate_user": True,
      "sqlalchemy_uri": sqlalchemy_url
    }

    response = session.post(url=url, headers=dict(Referrer=login_url), json=data_out)
    response.raise_for_status()

    return response


if __name__ == "__main__":

    username = "mysupersetuser"
    password = "mysupersetpass"

    db_user = "MYUSER"
    db_password = "MYDBPASS"
    db_host = "MYPOSTGRESIP"
    db_port = 5432
    db_name = "MYDBNAME"

    session = requests.session()

    login_url = base_url + "api/v1/security/login"

    login_data = {
      "password": password,
      "provider": "db",
      "refresh": False,
      "username": username
    }

    response = session.post(url=login_url, json=login_data)
    response.raise_for_status()

    head = {
        "Authorization": "Bearer " + json.loads(response.text)['access_token']
    }

    response = session.get(csrf_url, headers=head)
    response.raise_for_status()

    response = create_db_connection(session, db_ip=db_host, db_port=db_port, db_user=db_user, db_pass=db_password, db_name=db_name)

    print(str(response.text))

I see multiple ways people are stating to set the CSRF token.. but none have worked so far.

Always it's the same response 400

'{"errors": [{"message": "400 Bad Request: The CSRF token is missing.", "error_type": "GENERIC_BACKEND_ERROR", "level": "error", "extra": {"issue_codes": [{"code": 1011, "message": "Issue 1011 - Superset encountered an unexpected error."}]}}]}'

Answer 1

It looks like Apache-Superset uses Flask-AppBuilder which uses Flask_WTF. You should be able to set it in the request headers.

def create_db_connection(session, db_ip, db_port, db_user, db_pass, db_name, token_from_your_crsf_url):

    headers = {
        'Referrer': login_url,
        'X-CSRFToken': token_from_your_crsf_url
    }
    ...
    response = session.post(url=url, headers=headers, json=data_out)
    ...