apache/superset · error · ValidationError

{ex}

Error message

{ex}

What it means

The URI parsed fine, but check_sqlalchemy_uri raised SupersetSecurityException under PREVENT_UNSAFE_DB_CONNECTIONS (default true). The security check blocks connections that Superset treats as unsafe — notably SQLite and other file-based engines, plus hosts disallowed by configuration — and the exception message is surfaced verbatim as the validation error.

Source

Thrown at superset/databases/schemas.py:226

    """
    Validate if it's a valid SQLAlchemy URI and refuse SQLLite by default
    """
    try:
        uri = make_url_safe(value.strip())
    except DatabaseInvalidError as ex:
        raise ValidationError(
            [
                _(
                    "Invalid connection string, a valid string usually follows: "
                    "backend+driver://user:password@database-host/database-name"
                )
            ]
        ) from ex
    if current_app.config.get("PREVENT_UNSAFE_DB_CONNECTIONS", True):
        try:
            check_sqlalchemy_uri(uri)
        except SupersetSecurityException as ex:
            raise ValidationError([str(ex)]) from ex
    return value


def server_cert_validator(value: str) -> str:
    """
    Validate the server certificate
    """
    if value:
        try:
            parse_ssl_cert(value)
        except CertificateException as ex:
            raise ValidationError([_("Invalid certificate")]) from ex
    return value


def encrypted_extra_validator(value: str | None) -> None:
    """
    Validate that encrypted extra is a valid JSON string

View on GitHub (pinned to f4587218dd)

Solutions

1. Use a real client/server database (Postgres, MySQL, etc.) instead of SQLite when the guard is on.
2. If intentional and the deployment accepts the risk, set PREVENT_UNSAFE_DB_CONNECTIONS = False in superset_config.py (requires a Superset restart) — but understand it permits file-backed DBs.
3. Read the exact exception text: it states which aspect (engine type / host) was rejected.

Example fix

# before
sqlalchemy_uri: "sqlite:///tmp/superset_dev.db"  # rejected by default

# after
sqlalchemy_uri: "postgresql+psycopg2://superset:pw@localhost:5432/superset"
# or, accepting the risk, in superset_config.py:
# PREVENT_UNSAFE_DB_CONNECTIONS = False

from superset.utils.core import check_sqlalchemy_uri
from sqlalchemy.engine import make_url
try:
    check_sqlalchemy_uri(make_url(uri))
except SupersetSecurityException as ex:
    raise ValueError(f"URI blocked by policy: {ex}")

When it happens

Trigger: Creating a database with sqlite:///path/to.db (or any engine the check blocks) while PREVENT_UNSAFE_DB_CONNECTIONS is enabled (the default); also connecting to a host on a blocked network segment when the check is extended by deployment config.

Common situations: Local/dev setups wanting a scratch SQLite database; CI importing fixtures; security hardening policies that forbid file-backed engines because they can read server files.

Related errors

• Please provide a JWT secret at least 32 bytes long
• SSH Tunneling is not enabled
• security_error
• Cannot convert node type: ${node.type}
• Unsupported cache backend configuration

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/3c098a24a3cda8da. Report an issue: GitHub.