Reverse Proxy Configuration#

Running Superset behind a reverse proxy (Nginx, Apache, AWS ELB, etc.) requires coordinating configuration on both the proxy and the Superset application layers. The two primary concerns are: (1) telling Superset to trust and parse X-Forwarded-* headers from the proxy, and (2) sizing the proxy's request body limit appropriately.

ENABLE_PROXY_FIX and PROXY_FIX_CONFIG#

By default, ENABLE_PROXY_FIX = False 1. When set to True in superset_config.py, Superset wraps the Flask WSGI app with Werkzeug's ProxyFix middleware 2. This causes Flask to reconstruct the correct scheme, host, and client IP from the upstream headers rather than the raw socket values.

The companion setting PROXY_FIX_CONFIG controls how many trusted hops to accept for each header 1:

Each value is the number of trusted proxy hops (default: 1 for each). When proxying to a different port, set "x_port": 0 to avoid downstream redirect issues 3.

When to enable: Any time a load balancer or proxy is injecting X-Forwarded-For / X-Forwarded-Proto headers. This is required for correct OAuth redirect URI computation and for generating accurate HTTPS URLs 4 5.

Nginx Reference Configuration#

Superset's Docker setup ships two Nginx config files:

• docker/nginx/nginx.conf — global Nginx settings: client_max_body_size 10m 6, gzip compression, keepalive tuning.
• docker/nginx/templates/superset.conf.template — virtual server template. Key proxy headers set on the main location block 7:
  • proxy_set_header X-Real-IP $remote_addr
  • proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for
  • proxy_set_header X-Forwarded-Proto $scheme
  • proxy_connect_timeout 300 (for long-running queries)

The template also routes WebSocket connections to the Node-based async messaging server on port 8080 8.

Request body size: The default client_max_body_size is 10 MB 6. Uploads larger than this (e.g. large CSV imports or dashboard exports) will be rejected by Nginx with HTTP 413 before reaching Superset. Increase this value in nginx.conf or a server-level override as needed.

Apache Webserver#

When using Apache as the reverse proxy and terminating TLS, explicitly forward the protocol header 9:

RequestHeader set X-Forwarded-Proto "https"

Without this, X-Forwarded-Proto may be absent and Superset will generate http:// URLs even when users are accessing over HTTPS.

TLS Offloading and Internal Traffic#

When a proxy terminates TLS, Superset receives plain HTTP internally. Key implications:

• ENABLE_PROXY_FIX = True is required so Flask sees the correct https scheme 10.
• SESSION_COOKIE_SECURE (default False, 11) — setting this to True while Celery workers call Superset over plain HTTP will cause session cookies to be silently dropped, breaking Alerts & Reports screenshot generation.
• WEBDRIVER_BASEURL (default http://0.0.0.0:8080/, 12) is the internal URL Celery workers use; keep this as an http:// URL if TLS is terminated at the proxy.
• WEBDRIVER_BASEURL_USER_FRIENDLY should be set to the external HTTPS URL so notification emails contain valid links 13.

Kubernetes / Helm#

In Helm deployments, set ENABLE_PROXY_FIX via configOverrides to ensure SSL offloading works correctly with ingress controllers 14:

configOverrides:
  my_override: |
    ENABLE_PROXY_FIX = True

Key Source Files#