Getting forbidden Error while updating the widget size in the dashboard in the superset

[ketansharma78]

Screenshot

Description

I'm trying to update the widget size in Superset, but I'm getting a 403 Forbidden error.

[dosubot]

The 403 Forbidden error when resizing widgets on a dashboard is most likely caused by ownership verification. In Superset, editing a dashboard layout (including resizing/moving widgets) requires the current user to be either an Admin or a listed owner of that dashboard [1].

Even if you can view the dashboard, the backend enforces a strict ownership check via raise_for_ownership() for any modifications — including layout changes stored in position_json [2].

To resolve this, try one of the following:

1. Add yourself as a dashboard owner — Have an Admin go to the dashboard's properties and add your user to the "Owners" list.
2. Use an Admin account — Admins bypass all ownership checks.
3. Check your role — Ensure your role has the can_write permission on Dashboard. This is necessary but not sufficient on its own — you still need to be an owner.

If you're accessing this via an embedded dashboard or iframe, there are additional considerations around guest tokens and the can_read CurrentUserRestApi permission [3].

Could you confirm:

• What role is assigned to your user (Admin, Alpha, Gamma, or a custom role)?
• Are you listed as an owner of the dashboard you're trying to edit?

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[ketansharma78]

@dosu, The user has Admin privileges. The dashboard owner also has Admin privileges and has write access to the dashboard.

[rusackas]

Thanks @ketansharma78. That exact toast is a useful clue. When Superset itself denies a dashboard save, the UI shows "You do not have permission to edit this dashboard" instead. The ": Forbidden" variant only appears when the 403 response body isn't Superset's JSON, which usually means something in front of Superset (reverse proxy, WAF, SSO gateway) rejected the PUT before it reached the app. Large dashboard save payloads are a classic WAF false positive.

Could you open the browser devtools Network tab, retry the save, and share the response body and headers of the failing PUT /api/v1/dashboard/<id>? Also which Superset version you're on and what sits in front of it. I pinned that toast mapping with a test in #42250 so it stays a reliable signal.

[ketansharma78]

@rusackas, I have 14 widgets on the dashboard, and I'm using Apache Superset version 4.1.4. I also suspect that a large payload may be causing this issue. Is there a way to verify whether that's the case? If so, what would be the best approach to handle or mitigate it?