fix(telemetry): use Scarf static pixel instead of gateway redirect#41129
fix(telemetry): use Scarf static pixel instead of gateway redirect#41129rusackas wants to merge 4 commits into
Conversation
The Scarf telemetry pixel was gated only on `process.env.SCARF_ANALYTICS`, which webpack inlines at build time. On the official Docker image and the PyPI wheel the frontend is pre-built, so setting `SCARF_ANALYTICS=false` at container runtime (Helm `extraEnv`, docker/.env, etc.) had no effect — the documented opt-out simply didn't work for most deployments (#32110). Expose `SCARF_ANALYTICS` as a backend config read from the environment and ship it to the client via the bootstrap payload (`FRONTEND_CONF_KEYS`), then have RightMenu pass it to `<TelemetryPixel enabled>`. The build-time `process.env` check is kept as a short-circuit for source builds. Default is unchanged (telemetry on unless explicitly disabled). Docs (Kubernetes, Docker Compose, FAQ) updated to document the runtime opt-out; the k8s page previously only covered opting out of image-pull telemetry, not the pixel. Fixes #32110 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Code Review Agent Run #cd5607Actionable Suggestions - 0Additional Suggestions - 2
Review Details
Bito Usage GuideCommands Type the following command in the pull request comment and save the comment.
Refer to the documentation for additional commands. Configuration This repository uses Documentation & Help AI Code Review powered by |
github-actions
Bot
added
doc
✅ Deploy Preview for superset-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
The in-app telemetry pixel loaded from the Scarf Gateway redirect (apachesuperset.gateway.scarf.sh/pixel/...), which Chrome/Brave/Firefox and some extensions flag as a tracking redirect — surfacing Superset as a "dangerous"/phishing site for some users (#32110). Point the pixel at Scarf's native static endpoint that the gateway route already forwards to: https://static.scarf.sh/a.png?x-pxid=<id>&version=..&sha=..&build=.. Same pixel ID and the same version/sha/build dimensions (now query params), so telemetry is unchanged — only the flagged redirect hop is removed. static.scarf.sh was already in the CSP img-src allowlists; the gateway host is left in CSP so cached older bundles keep working during rollout. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
rusackas
force-pushed
the
fix/scarf-pixel-static-url
branch
from
a094976 to
7e46423
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #41129 +/- ##
==========================================
- Coverage 64.30% 64.30% -0.01%
==========================================
Files 2652 2652
Lines 144809 144812 +3
Branches 33417 33419 +2
==========================================
- Hits 93125 93123 -2
- Misses 50020 50023 +3
- Partials 1664 1666 +2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Code Review Agent Run #315ebcActionable Suggestions - 0Additional Suggestions - 1
Review Details
Bito Usage GuideCommands Type the following command in the pull request comment and save the comment.
Refer to the documentation for additional commands. Configuration This repository uses Documentation & Help AI Code Review powered by |
![codeant-ai-for-open-source[bot]](https://avatars.githubusercontent.com/u/151810221?s=60&v=4){kind=small}
|
The suggestion to add a docstring to the new test function is correct and improves code documentation. You can resolve this by adding a docstring that describes the test's purpose, as shown below: def test_scarf_analytics_is_exposed_to_frontend_config() -> None:
"""Verify that SCARF_ANALYTICS is exposed in frontend config keys."""
# Exposed at runtime so pre-built images can opt out via the SCARF_ANALYTICS
# config/env var (the webpack build-time flag cannot be changed there).
from superset.views.base import FRONTEND_CONF_KEYS
assert "SCARF_ANALYTICS" in FRONTEND_CONF_KEYSI have checked the other comments on this PR, and there are no other pending review comments to address. Please let me know if you would like me to assist with anything else. tests/unit_tests/views/test_base.py |
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Code Review Agent Run #de501dActionable Suggestions - 0Review Details
Bito Usage GuideCommands Type the following command in the pull request comment and save the comment.
Refer to the documentation for additional commands. Configuration This repository uses Documentation & Help AI Code Review powered by |
1 participant
SUMMARY
Second half of #32110. The in-app telemetry pixel loaded from the Scarf Gateway redirect —
https://apachesuperset.gateway.scarf.sh/pixel/<id>/<version>/<sha>/<build>— which Chrome/Brave/Firefox and some extensions flag as a tracking redirect, surfacing Superset as a "dangerous"/phishing site for affected users.Per Scarf's own guidance on the issue (cc @aviaviavi), point the pixel at the native static endpoint the gateway route already forwards to:
Confirmed against the Scarf project config — the package route's "File location" is exactly this static URL, and
0d3461e1-…is the same tracking-pixel ID already in the code. So:version/sha/buildare preserved (now query params instead of path segments). No data dimension is lost.static.scarf.shdirectly, removing the gateway redirect that triggers the warnings.static.scarf.shwas already in theimg-srcallowlists, so the pixel keeps working. Theapachesuperset.gateway.scarf.shhost is intentionally left in the CSP allowlists so any cached older bundles continue to function during rollout.Note: this only changes the in-app browser pixel. The
apachesuperset.docker.scarf.shimage-pull gateway and the@scarf/scarfnpm package (install-time analytics) are different channels and are untouched — neither runs in a browser, so neither is implicated in the warning.BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A. Network behavior:
GET apachesuperset.gateway.scarf.sh/pixel/…→ 302 →static.scarf.sh/a.png?…GET static.scarf.sh/a.png?x-pxid=…&version=…&sha=…&build=…(no redirect)TESTING INSTRUCTIONS
npm run test -- TelemetryPixel— asserts the pixelsrcnow starts withhttps://static.scarf.sh/, carries the version/sha/build params, and that nogateway.scarf.shimage is emitted.static.scarf.shhit with no redirect.ADDITIONAL INFORMATION
🤖 Generated with Claude Code