[Config] Cache static resources

UPDATING.md

@@ -23,6 +23,12 @@ assists people when migrating to a new version.
 
 ## Next Version
 
+* [8370](https://github.com/apache/incubator-superset/pull/8370): Deprecates
+  the `HTTP_HEADERS` variable in favor of `DEFAULT_HTTP_HEADERS` and
+  `OVERRIDE_HTTP_HEADERS`. To retain the same behavior you should use
+  `OVERRIDE_HTTP_HEADERS` instead of `HTTP_HEADERS`. `HTTP_HEADERS` will still
+  work but may be removed in a future update.
+
 * We're deprecating the concept of "restricted metric", this feature
   was not fully working anyhow.
 * [8117](https://github.com/apache/incubator-superset/pull/8117): If you are

superset/config.py

@@ -435,8 +435,14 @@ class CeleryConfig(object):
 # CELERY_CONFIG = None
 
 # Additional static HTTP headers to be served by your Superset server. Note
-# Flask-Talisman aplies the relevant security HTTP headers.
-HTTP_HEADERS = {}
+# Flask-Talisman applies the relevant security HTTP headers.
+#
+# DEFAULT_HTTP_HEADERS: sets default values for HTTP headers. These may be overridden
+# within the app
+# OVERRIDE_HTTP_HEADERS: sets override values for HTTP headers. These values will
+# override anything set within the app
+DEFAULT_HTTP_HEADERS = {}
+OVERRIDE_HTTP_HEADERS = {}
 
 # The db id here results in selecting this one as a default in SQL Lab
 DEFAULT_DB_ID = None
@@ -665,6 +671,9 @@ class CeleryConfig(object):
 SESSION_COOKIE_SECURE = False  # Prevent cookie from being transmitted over non-tls?
 SESSION_COOKIE_SAMESITE = "Lax"  # One of [None, 'Lax', 'Strict']
 
+# Flask configuration variables
+SEND_FILE_MAX_AGE_DEFAULT = 60 * 60 * 24 * 365  # Cache static resources
+
 # URI to database storing the example data, points to
 # SQLALCHEMY_DATABASE_URI by default if set to `None`
 SQLALCHEMY_EXAMPLES_URI = None

superset/views/core.py

@@ -3127,8 +3127,17 @@ class CssTemplateAsyncModelView(CssTemplateModelView):
 @app.after_request
 def apply_http_headers(response):
     """Applies the configuration's http headers to all responses"""
-    for k, v in config.get("HTTP_HEADERS").items():
+
+    # HTTP_HEADERS is deprecated, this provides backwards compatibility
+    for k, v in (
+        config.get("OVERRIDE_HTTP_HEADERS", {}).items()
+        | config.get("HTTP_HEADERS", {}).items()
+    ):
         response.headers[k] = v
+
+    for k, v in config.get("DEFAULT_HTTP_HEADERS", {}).items():
+        if k not in response.headers:
+            response.headers[k] = v
     return response