dosubot[bot] commented on issue #40714: URL: https://github.com/apache/superset/issues/40714#issuecomment-4613480850
<!-- Answer --> This is a confirmed issue. The root cause is exactly as you described — when `user_id` is `None`, the code sets `"sub": None` in the JWT payload [[1]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/async_events/async_query_manager.py#L179), and PyJWT >= 2.4 enforces that `sub` must be a string if present (per RFC 7519). **Existing fix:** [PR #37862](https://github.com/apache/superset/pull/37862) addresses this directly. The fix conditionally includes the `sub` claim only when `user_id` is not `None`, rather than encoding `None`: ```python payload = {"channel": async_channel_id} if user_id: payload["sub"] = str(user_id) token = jwt.encode(payload, ...) ``` Since `sub` is optional per RFC 7519, omitting it entirely is valid and PyJWT skips validation for missing claims. **Workaround** until the fix is merged: you can apply the same patch locally in `superset/async_events/async_query_manager.py` around line 179 [[1]](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/async_events/async_query_manager.py#L179). There are also two related security PRs worth noting: - [PR #40638](https://github.com/apache/superset/pull/40638) — adds token expiry (`exp` claim) to async query JWTs - [PR #40649](https://github.com/apache/superset/pull/40649) — rejects insecure default JWT secrets at startup when `GLOBAL_ASYNC_QUERIES` is enabled <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).* --- Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset). [](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=986bbe2f-5d2f-417e-bb08-d7ce8a6654d3) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
