apache/superset · error · TemporaryCacheAccessDeniedError

You don't have permission to modify the value.

Error message

You don't have permission to modify the value.

What it means

TemporaryCacheAccessDeniedError is raised by the explore form_data delete command when the cached state's 'owner' (user id recorded at creation) differs from the current get_user_id(). Access to the datasource was already checked via check_access; this second gate ensures only the creator may delete their temporary explore state.

Source

Thrown at superset/commands/explore/form_data/delete.py:55

class DeleteFormDataCommand(BaseCommand, ABC):
    def __init__(self, cmd_params: CommandParameters):
        self._cmd_params = cmd_params

    def run(self) -> bool:
        try:
            key = self._cmd_params.key
            state: TemporaryExploreState = cache_manager.explore_form_data_cache.get(
                key
            )
            if state:
                datasource_id: int = state["datasource_id"]
                chart_id: Optional[int] = state["chart_id"]
                datasource_type = DatasourceType(state["datasource_type"])
                check_access(datasource_id, chart_id, datasource_type)
                if state["owner"] != get_user_id():
                    raise TemporaryCacheAccessDeniedError()
                tab_id = self._cmd_params.tab_id
                contextual_key = cache_key(
                    session.get("_id"), tab_id, datasource_id, chart_id, datasource_type
                )
                cache_manager.explore_form_data_cache.delete(contextual_key)
                return cache_manager.explore_form_data_cache.delete(key)
            return False
        except SQLAlchemyError as ex:
            logger.exception("Error running delete command")
            raise TemporaryCacheDeleteFailedError() from ex

    def validate(self) -> None:
        pass

View on GitHub (pinned to f4587218dd)

Solutions

1. Only delete keys your own session created; if you received a shared link, copy the form data into your own state instead of deleting the original.
2. Re-authenticate as the original owner if you legitimately must remove the entry.
3. An admin can drop stale entries directly from the cache backend if cleanup is required.

state = cache_manager.explore_form_data_cache.get(key)
if state and state["owner"] != get_user_id():
    respond(403, "you did not create this explore state")

try:
    DeleteTemporaryExploreStateCommand(...).run()
except TemporaryCacheAccessDeniedError:
    # copy the form data into your own state instead of deleting the original

When it happens

Trigger: DELETE of an explore form_data cache key that was created by a different user — e.g. sharing an Explore link and the recipient's client issues a delete for the original key, or a user re-authenticates as a different account in the same browser session.

Common situations: Shared Explore URLs whose embedded key was minted by a colleague. Session/user switching in the same browser. Automation replaying captured delete calls with different credentials.

Related errors

• You don't have permission to modify the value.
• You don't have permission to modify the value.
• Dataset {existing.table_name!r} (uuid {config['uuid']}) alre
• Dataset {existing.table_name!r} (uuid {config['uuid']}) alre
• You don't have access to this dataset.

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/51087744826a6635. Report an issue: GitHub.