Repository navigation
Invalid UI URL's with SUPERSET_APP_ROOT #35027
Description
Bug description
The bug is that when I set custom app root with SUPERSET_APP_ROOT but some endpoints was generated incorrect.
SUPERSET_APP_ROOT: /analytics
-
Export dashboard -> http://hostname/analytics/analytics/api/v1/chart/data, but should be http://hostname/analytics/api/v1/chart/data (duplicate prefix)
-
Userinfo -> http://hostname/user_info/, but should be http://hostname/analytics/user_info/ (missing prefix)
-
Icon png -> https://hostname/static/assets/images/superset-logo-horiz.png, but should be https://hostname/analytics/static/assets/images/superset-logo-horiz.png (missing prefix)
Screenshots/recordings
Superset version
master / latest-dev
Python version
3.9
Node version
16
Browser
Chrome
Additional context
My full hem values.yaml
# https://github.com/apache/superset/tree/master/helm/superset
ingress:
enabled: true
ingressClassName: nginx
hosts:
- <hostname>
path: /
pathType: Prefix
tls: []
annotations:
nginx.ingress.kubernetes.io/proxy-connect-timeout: "300"
nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
nginx.ingress.kubernetes.io/proxy-body-size: 100M
nginx.ingress.kubernetes.io/configuration-snippet: |
if ($request_uri = "/") {
return 301 /analytics;
}
if ($request_uri = "/static/assets/images/superset-logo-horiz.png") {
return 301 /analytics/static/assets/images/superset-logo-horiz.png;
}
image:
tag: 6.0.0rc1
redis:
enabled: true
persistence:
enabled: false
postgresql:
enabled: true
primary:
persistence:
enabled: false
bootstrapScript: |
#!/bin/bash
apt-get update && apt-get install -y gcc && \
uv pip install \
psycopg2-binary==2.9.10 \
clickhouse-connect==0.7.7 \
PyJWT==2.10.1 \
authlib
configOverrides:
secret: |
from flask import g
from jinja2 import pass_context
from flask_appbuilder.security.manager import AUTH_DB
SECRET_KEY = 's/lfxyPiVXz1H/mkCueBTJuTH7FlVoqCWVLCmOPqsCdE21pxoq4H4LNo'
@pass_context
def current_tenant(context, *args, **kwargs):
return getattr(g, "tenant_id", None) or "-1"
JINJA_CONTEXT_ADDONS = {
"current_tenant": current_tenant,
}
AUTH_TYPE = AUTH_DB
OAUTH_PROVIDERS = []
AUTH_USER_REGISTRATION = False
FEATURE_FLAGS = {
"ALLOW_FULL_CSV_EXPORT": True,
"ALERT_REPORTS": True,
"DASHBOARD_RBAC": True,
"ENABLE_TEMPLATE_PROCESSING" : True,
}
SQL_MAX_ROW = 300000
ROW_LIMIT = 300000
SESSION_COOKIE_SAMESITE = 'Lax'
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SECURE = False
TALISMAN_ENABLED = False
PUBLIC_ROLE_LIKE = "Gamma"
supersetNode:
env:
SUPERSET_APP_ROOT: /analytics
KEYCLOAK_BASE_URL: http://keycloak.dev.svc.cluster.local
livenessProbe:
httpGet:
path: /analytics/health
readinessProbe:
httpGet:
path: /analytics/health
startupProbe:
httpGet:
path: /analytics/health
configOverridesFiles:
custom_security_manager: files/custom_security_manager.py
custom_jwt_middleware: files/custom_jwt_middleware.py
custom_app_initialyzer: files/custom_app_initialyzer.py
clickhouse_connect_uri: host
extraConfigs:
import_datasources.yaml: |
{{ tpl (.Files.Get "files/import_datasources.yaml") . }}
Workaround with extra Ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: superset-fix
namespace: {{ .Release.Namespace }}
annotations:
meta.helm.sh/release-name: superset-fix
meta.helm.sh/release-namespace: {{ .Release.Namespace }}
nginx.ingress.kubernetes.io/proxy-body-size: 100M
nginx.ingress.kubernetes.io/proxy-connect-timeout: '300'
nginx.ingress.kubernetes.io/proxy-read-timeout: '300'
nginx.ingress.kubernetes.io/proxy-send-timeout: '300'
nginx.ingress.kubernetes.io/rewrite-target: /analytics/$2
nginx.ingress.kubernetes.io/use-regex: 'true'
spec:
ingressClassName: nginx
rules:
- host: hostname
http:
paths:
- path: /analytics/analytics(/|$)(.*)
pathType: ImplementationSpecific
backend:
service:
name: superset
port:
number: 8088
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: superset-userinfo-redirect
namespace: {{ .Release.Namespace }}
annotations:
nginx.ingress.kubernetes.io/use-regex: "true"
# Permanent redirect to /analytics/user_info/
nginx.ingress.kubernetes.io/permanent-redirect: "https://hostname/analytics/user_info/"
spec:
ingressClassName: nginx
rules:
- host: hostname
http:
paths:
# Only match /user_info
- path: "/user_info(/|$)"
pathType: ImplementationSpecific
backend:
service:
name: superset
port:
number: 8088
Checklist
- I have searched Superset docs and Slack and didn't find a solution to my problem.
- I have searched the GitHub issue tracker and didn't find a similar bug report.
- I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
Activity
dosubot commentedon Sep 5, 2025
Hi @Nurshinov! I'm Dosu and I’m helping the superset team.
Recent changes in Superset's frontend and backend have addressed issues with incorrect URL generation when using a custom SUPERSET_APP_ROOT. The frontend now consistently includes the appRoot prefix in endpoint URLs, preventing duplicate or missing prefixes for actions like login redirects and API calls (PR #34395). The bootstrap data handling was also improved to ensure application_root and static_assets_prefix are always set and normalized (PR #34680).
On the backend, setting SUPERSET_APP_ROOT triggers middleware that adjusts routing and automatically sets STATIC_ASSETS_PREFIX and APPLICATION_ROOT if not explicitly configured (app.py). For deployments under a subpath, it's important to set ENABLE_PROXY_FIX=True and configure your proxy (e.g., nginx) to set the X-Forwarded-Prefix header and route both static assets and API endpoints correctly (issue #34773).
If you're running the latest-dev branch, these fixes should be included. Double-check your environment variables and proxy configuration to ensure STATIC_ASSETS_PREFIX and APPLICATION_ROOT match your SUPERSET_APP_ROOT, and that your ingress/proxy sets X-Forwarded-Prefix. If you still see issues, make sure your frontend build is up-to-date and not caching old bootstrap data.
To reply, just mention @dosu.
Docs are dead. Just use Dosu.
Nurshinov commentedon Sep 5, 2025
@dosu No, it still doesn't work even with:
and X-Forwarded-Prefix
dosubot commentedon Sep 5, 2025
Your config matches the documented approach, but there are still known edge cases and ongoing fixes for subpath deployments. Here are some key points and troubleshooting steps:
If you still see issues, check the actual bootstrap data in your browser's dev tools (look for application_root and static_assets_prefix in the main page's JSON payload) and confirm they match your config. Also, verify that your ingress/proxy is not rewriting or stripping prefixes unexpectedly.
If you want to try the most robust config, set only SUPERSET_APP_ROOT=/analytics and ENABLE_PROXY_FIX=True, and let Superset auto-fill the other values. Make sure your proxy sets X-Forwarded-Prefix: /analytics and does not rewrite paths in a way that could cause double prefixing.
References:
To reply, just mention @dosu.
Share context across your team and agents. Try Dosu.
msyavuz commentedon Sep 5, 2025
I think the work for this was done by @martyngigg so maybe they have an input on this?
martyngigg commentedon Sep 8, 2025
I think these are genuine bugs that have crept in since #30134 was merged. Number 3 is covered in #34935.
During #30134 there was a concern that having to scatter the calls to ensure the app root prefix was in place would become an issue. I guess these parts are not covered by tests. @rusackas Should this be considered a blocker to 6.0 release?
sadpandajoe commentedon Sep 24, 2025
@martyngigg to answer if this should be a blocker for 6.0, the question would be if this happens in 5.0 or not. If it doesn't then it's a new issue but if it does then probably a pre-existing issue.
josecanciani commentedon Sep 24, 2025
I can say I can't make it work with 5.0.0.
sadpandajoe commentedon Sep 24, 2025
@josecanciani so this is a problem we are also seeing in 5.0.0?
josecanciani commentedon Sep 24, 2025
I'm new to Superset, I've been working with it for a couple of months, so I'm not very experienced. We are trying to integrate it using JWT guest tokens and embedded support. To make it work, we also need to setup a reverse proxy in our NGINX, so I need it working on a specific path. I've tried different combinations of these settings without luck on 5.0.0:
It still redirects or loads some javascript from other places. In master branch, the same thing.
BTW I couldn't make JWT tokens to work either... but that's a different problem.
martyngigg commentedon Sep 25, 2025
This app_root functionality was merged to master in #30134 but it was too late for the v5 release so v6 will be its first official release. @sadpandajoe This would mean the bug didn't exist in 5 because the functionality didn't so I don't quite know how that stacks up ffor it being a blocker?
sadpandajoe commentedon Sep 25, 2025
Ok i think it's not a blocker for now then and we can treat these as new issues.
scottyeung commentedon Oct 2, 2025
The subpath also went missing when I tried to use Swagger in 6.0.0rc2.
Works again after I added it manually
NOT FOUND /api/v1/_openapi7 remaining items
fvazquez-sgs commentedon Oct 23, 2025
The "settings->logout" menu item also does not include the superset_app_root variable in its path.
The following menu entries also do not contain the root path
othoqura commentedon Oct 26, 2025
@dosu any fix related to Userinfo -> http://hostname/user_info/, but should be http://hostname/analytics/user_info/ (missing prefix)
dosubot commentedon Oct 26, 2025
There isn't a fix yet for the Userinfo URL missing the SUPERSET_APP_ROOT prefix—this is a known gap in subpath support. The Userinfo endpoint is still hardcoded as
/user_info/in both the frontend and backend, so it doesn't include your app root (like/analytics) when deployed under a subpath. This is the same root cause as other missing-prefix bugs (like static assets and some menu links) and is a limitation of the current BETA subpath deployment feature.Recent fixes (like for Export CSV and OAuth login links) use a utility (
ensureAppRoot) to prepend the app root, but this hasn't been applied to Userinfo yet. Until an upstream fix lands, the only workaround is to use proxy rewrites or custom middleware to redirect/user_info/to the correct prefixed path.You can track similar issues and see the recommended fix pattern in this discussion and this related PR.
To reply, just mention @dosu.
How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other
scottyeung commentedon Oct 26, 2025
Better check Dataset page to see any SQL Lab related button has
ensureAppRootmissing. I've found a coupleothoqura commentedon Oct 27, 2025
I think this one need to be fixed https://github.com/apache/superset/blob/master/superset-frontend/src/features/home/RightMenu.tsx#L488
to something like this
<Typography.Link href={ensureAppRoot(navbarRight.user_info_url)}>{t('Info')}</Typography.Link>martyngigg commentedon Nov 10, 2025
@fvazquez-sgs On the latest master I seem to have both logout and "row level security" prefixed with the app root in my development setup. My menu seems to be missing the options like
Base Permissions- could you help me with what I need to do to enable them?fvazquez-sgs commentedon Nov 10, 2025
@martyngigg
We have enabled this options:
FAB_ADD_SECURITY_PERMISSION_VIEW = True
FAB_ADD_SECURITY_VIEW_MENU_VIEW = True
FAB_ADD_SECURITY_PERMISSION_VIEWS_VIEW = True
FAB_ADD_SECURITY_ROLE_VIEW = True
FAB_ADD_SECURITY_USER_VIEW = True
martyngigg commentedon Nov 10, 2025
@Nurshinov #36054 should solve the problem with the user info. #34935 should solve the broken icon.
I can't reproduce the export dashboard problem - it seems to work for me on the current master, both export as pdf and image, with
SUPERSET_APP_ROOT=/workspace/example.martyngigg commentedon Nov 10, 2025
@fvazquez-sgs Thanks for the pointer to the additional FAB menu items. For me the url correctly included the app root but the pages didn't work as there were some old template references lying around. These are now fixed in #36058.
martyngigg commentedon Nov 10, 2025
I believe I have fixed all of the issues reported here in #36058. If you were able to test the pull request fixes your setup that would be much appreciated 😄 .
hmendezm commentedon Feb 13, 2026
Hi guys, I am trying to use subroutes (e.g /dev and /qa), and I set up the ingress and values.yaml as it is mentioned here. I still have 404. I am using superset 6.0.0
Did someone manage to configure this so subroute works?
Best
H. Mendez