apache/superset · error · TemporaryCacheAccessDeniedError

You don't have permission to modify the value.

Error message

You don't have permission to modify the value.

What it means

TemporaryCacheAccessDeniedError ('You don't have permission to modify the value.') is raised by DeleteFilterStateCommand.delete() when the cached filter-state entry's 'owner' does not match the current user id. Access to the dashboard itself already passed check_access(resource_id); this check protects ownership of the specific cached filter state, so users cannot delete each other's saved filter selections.

Source

Thrown at superset/commands/dashboard/filter_state/delete.py:37

from superset.commands.dashboard.filter_state.utils import check_access
from superset.commands.temporary_cache.delete import DeleteTemporaryCacheCommand
from superset.commands.temporary_cache.entry import Entry
from superset.commands.temporary_cache.exceptions import TemporaryCacheAccessDeniedError
from superset.commands.temporary_cache.parameters import CommandParameters
from superset.extensions import cache_manager
from superset.temporary_cache.utils import cache_key
from superset.utils.core import get_user_id


class DeleteFilterStateCommand(DeleteTemporaryCacheCommand):
    def delete(self, cmd_params: CommandParameters) -> bool:
        resource_id = cmd_params.resource_id
        key = cache_key(resource_id, cmd_params.key)
        check_access(resource_id)
        entry: Entry = cache_manager.filter_state_cache.get(key)
        if entry:
            if entry["owner"] != get_user_id():
                raise TemporaryCacheAccessDeniedError()
            tab_id = cmd_params.tab_id
            contextual_key = cache_key(session.get("_id"), tab_id, resource_id)
            cache_manager.filter_state_cache.delete(contextual_key)
            return cache_manager.filter_state_cache.delete(key)
        return False

View on GitHub (pinned to f4587218dd)

Solutions

1. Only delete filter states the current user created; regenerate the key via the user's own GET of the filter state.
2. In tests, create and delete the state under the same authenticated user.
3. If a shared filter state is genuinely needed, design for it at the dashboard level (default filters in json_metadata), not by reusing cached personal state.

Example fix

# before
# created with user A, deleted with user B -> TemporaryCacheAccessDeniedError
client_b.delete(f'/api/v1/dashboard/{rid}/filter_state/{key}')

# after
entry = cache_manager.filter_state_cache.get(cache_key(rid, key))
if entry and entry['owner'] == get_user_id():
    client.delete(f'/api/v1/dashboard/{rid}/filter_state/{key}')

from superset.temporary_cache.utils import cache_key
from superset.utils.core import get_user_id

entry = cache_manager.filter_state_cache.get(cache_key(resource_id, key))
if entry is None or entry['owner'] != get_user_id():
    skip_delete('filter state absent or not owned by current user')

try:
    DeleteFilterStateCommand().delete(cmd_params)
except TemporaryCacheAccessDeniedError:
    # key belongs to another user; regenerate a fresh key instead
    request_new_filter_state_key()

When it happens

Trigger: DELETE on the dashboard filter-state cache endpoint for a (resource_id, key) whose entry was stored by a different user — e.g. a key learned from logs, a shared browser profile, or replaying another user's state key.

Common situations: Shared workstations where a second user reuses a URL containing another user's filter-state key; test harnesses that create state as one user and delete as another; multi-tab sessions after an account switch without clearing cache keys.

Related errors

• You don't have permission to modify the value.
• Changing this chart is forbidden
• You don't have access to this chart.
• Changing this Dashboard is forbidden
• You don't have permission to modify the value.

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/db4aeae031e234c8. Report an issue: GitHub.