{"record":{"id":"db4aeae031e234c8","repo":"apache/superset","slug":"you-don-t-have-permission-to-modify-the-value","errorCode":null,"errorMessage":"You don't have permission to modify the value.","messagePattern":"You don't have permission to modify the value\\.","errorType":"exception","errorClass":"TemporaryCacheAccessDeniedError","httpStatus":403,"severity":"error","filePath":"superset/commands/dashboard/filter_state/delete.py","lineNumber":37,"sourceCode":"from superset.commands.dashboard.filter_state.utils import check_access\nfrom superset.commands.temporary_cache.delete import DeleteTemporaryCacheCommand\nfrom superset.commands.temporary_cache.entry import Entry\nfrom superset.commands.temporary_cache.exceptions import TemporaryCacheAccessDeniedError\nfrom superset.commands.temporary_cache.parameters import CommandParameters\nfrom superset.extensions import cache_manager\nfrom superset.temporary_cache.utils import cache_key\nfrom superset.utils.core import get_user_id\n\n\nclass DeleteFilterStateCommand(DeleteTemporaryCacheCommand):\n    def delete(self, cmd_params: CommandParameters) -> bool:\n        resource_id = cmd_params.resource_id\n        key = cache_key(resource_id, cmd_params.key)\n        check_access(resource_id)\n        entry: Entry = cache_manager.filter_state_cache.get(key)\n        if entry:\n            if entry[\"owner\"] != get_user_id():\n                raise TemporaryCacheAccessDeniedError()\n            tab_id = cmd_params.tab_id\n            contextual_key = cache_key(session.get(\"_id\"), tab_id, resource_id)\n            cache_manager.filter_state_cache.delete(contextual_key)\n            return cache_manager.filter_state_cache.delete(key)\n        return False\n","sourceCodeStart":19,"sourceCodeEnd":43,"githubUrl":"https://github.com/apache/superset/blob/f4587218dd19d046c3e4d00063e7d27f8a2ed354/superset/commands/dashboard/filter_state/delete.py#L19-L43","documentation":"TemporaryCacheAccessDeniedError ('You don't have permission to modify the value.') is raised by DeleteFilterStateCommand.delete() when the cached filter-state entry's 'owner' does not match the current user id. Access to the dashboard itself already passed check_access(resource_id); this check protects ownership of the specific cached filter state, so users cannot delete each other's saved filter selections.","triggerScenarios":"DELETE on the dashboard filter-state cache endpoint for a (resource_id, key) whose entry was stored by a different user — e.g. a key learned from logs, a shared browser profile, or replaying another user's state key.","commonSituations":"Shared workstations where a second user reuses a URL containing another user's filter-state key; test harnesses that create state as one user and delete as another; multi-tab sessions after an account switch without clearing cache keys.","solutions":["Only delete filter states the current user created; regenerate the key via the user's own GET of the filter state.","In tests, create and delete the state under the same authenticated user.","If a shared filter state is genuinely needed, design for it at the dashboard level (default filters in json_metadata), not by reusing cached personal state."],"exampleFix":"# before\n# created with user A, deleted with user B -> TemporaryCacheAccessDeniedError\nclient_b.delete(f'/api/v1/dashboard/{rid}/filter_state/{key}')\n\n# after\nentry = cache_manager.filter_state_cache.get(cache_key(rid, key))\nif entry and entry['owner'] == get_user_id():\n    client.delete(f'/api/v1/dashboard/{rid}/filter_state/{key}')","handlingStrategy":"try-catch","validationCode":"from superset.temporary_cache.utils import cache_key\nfrom superset.utils.core import get_user_id\n\nentry = cache_manager.filter_state_cache.get(cache_key(resource_id, key))\nif entry is None or entry['owner'] != get_user_id():\n    skip_delete('filter state absent or not owned by current user')","typeGuard":null,"tryCatchPattern":"try:\n    DeleteFilterStateCommand().delete(cmd_params)\nexcept TemporaryCacheAccessDeniedError:\n    # key belongs to another user; regenerate a fresh key instead\n    request_new_filter_state_key()","preventionTips":["Never reuse filter-state keys across user accounts.","Create and delete cached state under the same authenticated principal in tests.","Clear cached keys on logout / account switch."],"tags":["security","cache","filter-state","ownership","forbidden"],"backgroundTag":null,"analyzedSha":"f4587218dd19d046c3e4d00063e7d27f8a2ed354","analyzedAt":"2026-08-14T22:39:27.425Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}