How to hide queries from superset responses

[asishPatnaik2000]

How to hide queries from superset responses as it is causing security issues. Information Disclosure / Sensitive Data Exposure (DB tables and queries) this issues is reported by our security team

Is there any way to remove the query or hide it?

in query key actual db query is coming

currently I have removed it for security purposes from response of
api: https://{{url}}/api/v1/chart/data

{
"result": [
{
"cache_key": "fc027ae4bee27fcb671ab56a42183256",
"cached_dttm": null,
"cache_timeout": 86400,
"applied_template_filters": [],
"annotation_data": {},
"error": null,
"is_cached": null,
"query": "",
"status": "success",
"stacktrace": null,
"rowcount": 1,
"sql_rowcount": 1,
"from_dttm": null,
"to_dttm": null,
"label_map": {
"display_name_without_id": [
"display_name_without_id"
]
},
"colnames": [
"display_name_without_id"
],
"indexnames": [
0
],
"coltypes": [
1
],
"data": [
{
"display_name_without_id": "..."
}
],
"result_format": "json",
"applied_filters": [],
"rejected_filters": []
}
]
}

[dosubot[bot]]

Superset does not offer a built-in configuration to hide or remove the SQL query from API responses for authenticated users. By default, the /api/v1/chart/data endpoint includes the actual query in the query field. However, for guest (embedded) users, Superset removes the query field from the response using logic in the backend (source).

To apply this for all users, you would need to modify the backend code—specifically, update the _send_chart_response method in ChartDataRestApi to remove or redact the query key for every user, not just guests. There is no documented configuration or feature flag for this, so a code change is required (source).

If you need implementation pointers, look for the section in _send_chart_response where it checks security_manager.is_guest_user() and pops the query key from each query object. You can generalize this logic to apply for all users.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[dosubot[bot]]

There isn't a supported way to remove or hide the query field from Superset API responses using nginx or configuration files. Nginx is typically used as a reverse proxy and doesn't modify JSON response bodies in a maintainable way, and Superset's config files don't offer an option for this either (docs, nginx.conf).

If you want to avoid backend code changes, the closest alternative is to write a custom Python middleware and register it via the ADDITIONAL_MIDDLEWARE setting in superset_config.py. This middleware could intercept responses and strip the query field, but it requires custom implementation and careful handling to avoid breaking other endpoints (middleware docs).

Backend code modification remains the most robust and maintainable solution.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[asishPatnaik2000]

@dosu what middleware code to be added in superset_config.py to intecept all api to hide sensitive info in response?

[dosubot[bot]]

You can add a custom middleware in superset_config.py to intercept all API responses and remove sensitive fields like "query" from JSON responses. Here’s a sample middleware you can use:

import json

class HideQueryFieldMiddleware:
    def __init__(self, app):
        self.app = app

    def __call__(self, environ, start_response):
        # Capture the response from the downstream app
        response_body = []
        status_headers = {}

        def custom_start_response(status, headers, exc_info=None):
            status_headers['status'] = status
            status_headers['headers'] = headers
            return response_body.append

        result = self.app(environ, custom_start_response)
        body = b"".join(response_body + list(result))

        # Only process JSON responses
        headers = dict(status_headers['headers'])
        content_type = headers.get('Content-Type', '')
        if 'application/json' in content_type:
            try:
                data = json.loads(body)
                # Recursively remove 'query' keys
                def remove_query(obj):
                    if isinstance(obj, dict):
                        obj.pop('query', None)
                        for v in obj.values():
                            remove_query(v)
                    elif isinstance(obj, list):
                        for item in obj:
                            remove_query(item)
                remove_query(data)
                body = json.dumps(data).encode('utf-8')
                # Update Content-Length
                for i, (k, v) in enumerate(status_headers['headers']):
                    if k.lower() == 'content-length':
                        status_headers['headers'][i] = (k, str(len(body)))
            except Exception:
                pass  # If parsing fails, return the original body

        start_response(status_headers['status'], status_headers['headers'])
        return [body]

To enable this middleware, add it to your superset_config.py:

ADDITIONAL_MIDDLEWARE = [HideQueryFieldMiddleware]

This will remove all "query" fields from JSON responses for all API endpoints. Test thoroughly to ensure it doesn’t break any expected functionality. For more details on middleware setup, see the networking settings docs.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[asishPatnaik2000]

@dosu how to hide queries from request body as well

[dosubot[bot]]

There isn't a supported or practical way to hide or redact SQL queries from the request body in Superset. The backend requires the query information in the request body to function—removing or redacting it before processing would break chart rendering, SQL Lab, and other core features. Middleware or config options for intercepting and modifying request bodies are not available, and attempting to do so would likely cause errors or failed requests (example).

If you need to prevent sensitive queries from being sent, you'll need to address this at the client/UI level or restrict API access via authentication and permissions. Let me know if you want to discuss specific endpoints or security hardening strategies.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}