Superset Dev 9b1f66823b fix(embedded): stop rendering dashboard title/description before guest auth ...

The Referer and Sec-Fetch-Dest checks on the pre-token embed page are
browser-cooperation only; a non-browser client can forge or omit both
headers, so anything the page renders is effectively reachable by
knowing an embed UUID. Stop passing the dashboard title and description
into the template at this stage. The embedded SPA already fetches
dashboard metadata through the guest-token-authenticated API once it
holds a token, so the pre-auth page falls back to a generic title.

2026-08-21 00:47:02 -07:00

..

__init__.py

…

api_tests.py

chore(dao/command): Add transaction decorator to try to enforce "unit of work" (#24969)

2024-06-28 12:33:56 -07:00

dao_tests.py

chore: enable lint PT009 'use regular assert over self.assert.*' (#30521)

2024-10-07 13:17:27 -07:00

test_view.py

fix(embedded): stop rendering dashboard title/description before guest auth

2026-08-21 00:47:02 -07:00