EMMMLZZ opened a new issue, #28598:
URL: https://github.com/apache/superset/issues/28598

   ### Bug description
   
   
   I started the superset4.0 service locally. A third-party application was 
also written to work with embedded dashboards by using 
@superset-ui/embedded-sdk.
   
   However, upon requesting /api/v1/security/guest_token/, a 422 status code 
was received with the following error message:
   
   
![422](https://github.com/apache/superset/assets/107025044/6fbe647d-dd94-481e-8774-79041da3727b)
   
   **{
   "msg": "Invalid header string: Expecting value: line 1 column 1 (char 0)"
   }**
   
   
![422postmanpng](https://github.com/apache/superset/assets/107025044/481eb670-a2fa-41c6-8512-0d075d8e67c2)
   
   By investigating the code, I discovered that commenting out the @protect() 
annotation on the guest_token method in security/api.py allows for successfully 
receiving the GuestToken from the API. However, this is not the desired 
solution. I am eagerly seeking someone who can provide an explanation for the 
cause of this issue and offer a proper resolution.
   
![Snipaste_2024-05-20_17-22-15](https://github.com/apache/superset/assets/107025044/d48b5d29-b345-43e6-aa3a-ee6ae057b0e3)
   
   
   ### How to reproduce the bug
   
   **My congfig.py configuration is as follows:**
   
   GUEST_ROLE_NAME = "Embedded_Role"
   PUBLIC_ROLE_LIKE_GAMMA = True
   GUEST_TOKEN_JWT_SECRET = "test-guest-secret-change-me"
   GUEST_TOKEN_JWT_ALGO = "HS256"
   GUEST_TOKEN_HEADER_NAME = "X-GuestToken"
   GUEST_TOKEN_JWT_EXP_SECONDS = 300  # 5 minutes
   # Guest token audience for the embedded superset, either string or callable
   GUEST_TOKEN_JWT_AUDIENCE: Callable[[], str] | str | None = None
   
   ENABLE_CORS = True
   CORS_OPTIONS: dict[Any, Any] = {
       'supports_credentials': True,
       'allow_headers': ['*'],
       'resources': ['*'],
       # 'origins': ['*']
       'origins': ['http://localhost:8088', 'http://localhost:8000']
   }
   
   HTTP_HEADERS: dict[str, Any] = {"X-Frame-Options": "ALLOWALL"}
   
   **The Embedded_Role permissions are as follows:**
   
![Sni111118](https://github.com/apache/superset/assets/107025044/8b601fd2-e24d-4cca-be32-756641ec2ecd)
   I created an Embedded_Role by copying the Gamma role and added the "can 
grant guest token on SecurityRestApi" permission to it.
   
   **The code for the third-party application that I have written is as 
follows:**
   
![Snip12-54](https://github.com/apache/superset/assets/107025044/7cfdc79e-ce9c-4d2a-b90d-cf2f810a2415)
   
   
![Snipaste_23333-44](https://github.com/apache/superset/assets/107025044/691044ca-503a-4fb9-91a2-a300ba4189e0)
   
   I would like someone who has shared experiences to join me in discussing 
this issue.
   
   ### Screenshots/recordings
   
   _No response_
   
   ### Superset version
   
   4.0.1
   
   ### Python version
   
   3.10
   
   ### Node version
   
   18 or greater
   
   ### Browser
   
   Chrome
   
   ### Additional context
   
   _No response_
   
   ### Checklist
   
   - [X] I have searched Superset docs and Slack and didn't find a solution to 
my problem.
   - [X] I have searched the GitHub issue tracker and didn't find a similar bug 
report.
   - [ ] I have checked Superset's logs for errors and if I found a relevant 
Python stacktrace, I included it here as text in the "additional context" 
section.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to