apache/superset · error · TemporaryCacheAccessDeniedError

You don't have permission to modify the value.

Error message

You don't have permission to modify the value.

What it means

TemporaryCacheAccessDeniedError is raised by UpdateFilterStateCommand.update() when the existing cached filter-state entry's 'owner' differs from the current user id. Dashboard access already passed; this is an ownership check on the cached value, preventing one user from overwriting another user's saved filter state under the same key.

Source

Thrown at superset/commands/dashboard/filter_state/update.py:42

from superset.commands.temporary_cache.parameters import CommandParameters
from superset.commands.temporary_cache.update import UpdateTemporaryCacheCommand
from superset.extensions import cache_manager
from superset.key_value.utils import random_key
from superset.temporary_cache.utils import cache_key
from superset.utils.core import get_user_id


class UpdateFilterStateCommand(UpdateTemporaryCacheCommand):
    def update(self, cmd_params: CommandParameters) -> Optional[str]:
        resource_id = cmd_params.resource_id
        key = cmd_params.key
        value = cast(str, cmd_params.value)  # schema ensures that value is not optional
        check_access(resource_id)
        entry: Entry = cache_manager.filter_state_cache.get(cache_key(resource_id, key))
        owner = get_user_id()
        if entry:
            if entry["owner"] != owner:
                raise TemporaryCacheAccessDeniedError()

            # Generate a new key if tab_id changes or equals 0
            contextual_key = cache_key(
                session.get("_id"), cmd_params.tab_id, resource_id
            )
            key = cache_manager.filter_state_cache.get(contextual_key)
            if not key or not cmd_params.tab_id:
                key = random_key()
                cache_manager.filter_state_cache.set(contextual_key, key)

            new_entry: Entry = {"owner": owner, "value": value}
            cache_manager.filter_state_cache.set(cache_key(resource_id, key), new_entry)
        return key

View on GitHub (pinned to f4587218dd)

Solutions

1. Create the filter state and update it under the same user; have the updating user issue the initial POST that generates the key.
2. If updating another user's state is an admin requirement, do it server-side with explicit tooling, not through the per-user cache API.
3. Clear stale keys on logout in the frontend so a switched account never reuses prior keys.

Example fix

# before
client_a.post(f'/api/v1/dashboard/{rid}/filter_state/', ...)
client_b.put(f'/api/v1/dashboard/{rid}/filter_state/{key}', ...)  # 403

# after
# single principal owns the full lifecycle
client.put(f'/api/v1/dashboard/{rid}/filter_state/{key}', ...)

from superset.temporary_cache.utils import cache_key
from superset.utils.core import get_user_id

entry = cache_manager.filter_state_cache.get(cache_key(resource_id, key))
if entry and entry['owner'] != get_user_id():
    # create own state under a new key rather than updating someone else's
    key = create_own_filter_state(resource_id)

try:
    UpdateFilterStateCommand().update(cmd_params)
except TemporaryCacheAccessDeniedError:
    # fall back to creating a new personal state entry
    create_new_state_and_redirect()

When it happens

Trigger: PUT on the dashboard filter-state endpoint with a (resource_id, key) owned by another user: replaying a captured key from logs or a shared URL, or a test/automation flow that writes the initial state under a different account than the update.

Common situations: Integration tests where login switches between create and update steps; account switch in the same browser session retaining old keys; scripts copying filter-state keys between users to 'share' dashboard states.

Related errors

• You don't have permission to modify the value.
• Changing this chart is forbidden
• You don't have access to this chart.
• Changing this Dashboard is forbidden
• You don't have permission to modify the value.

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/a0ce1fe53aeaf300. Report an issue: GitHub.