QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-04-27 03:55:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(embedded): add feature flag to disable logout button in embedded contexts (#37537)

Browse Source 
Co-authored-by: richard <richard@richards-MacBook-Pro-2.local>
This commit is contained in:
Richard Fogaca Nienkotter
2026-02-23 17:56:02 -03:00
committed by GitHub
parent c4eb7de6de
commit e06427d1ef
6 changed files with 138 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
docs/docs/configuration/networking-settings.mdx
View File

@@ -96,6 +96,24 @@ To enable this entry, add the following line to the `.env` file:
SUPERSET_FEATURE_EMBEDDED_SUPERSET=true
```
### Hiding the Logout Button in Embedded Contexts
When Superset is embedded in an application that manages authentication via SSO (OAuth2, SAML, or JWT), the logout button should be hidden since session management is handled by the parent application.
To hide the logout button in embedded contexts, add to `superset_config.py`:
```python
FEATURE_FLAGS = {
"DISABLE_EMBEDDED_SUPERSET_LOGOUT": True,
}
```
This flag only hides the logout button when Superset detects it is running inside an iframe. Users accessing Superset directly (not embedded) will still see the logout button regardless of this setting.
:::note
When embedding with SSO, also set `SESSION_COOKIE_SAMESITE = 'None'` and `SESSION_COOKIE_SECURE = True`. See [Security documentation](/docs/security/securing_superset) for details.
:::
## CSRF settings
Similarly, [flask-wtf](https://flask-wtf.readthedocs.io/en/0.15.x/config/) is used to manage