bito-code-review[bot] commented on PR #43391:
URL: https://github.com/apache/superset/pull/43391#issuecomment-5372405309
<!-- Bito Reply -->
The flagged issue is correct. Deriving the channel ID from the entire guest
token, including `iat` (issued-at) and `exp` (expiration), causes the channel
identity to change whenever a token is refreshed. This breaks the connection
for in-flight async jobs, as the client and server no longer agree on the
channel ID.
To resolve this, you should derive the channel ID from a stable claim that
persists across token refreshes, such as a unique session identifier or a
user-specific claim that remains constant for the duration of the embedded
session. You should exclude volatile claims like `iat` and `exp` from the
channel derivation logic.
I have checked the PR comments, and there are no other actionable
suggestions in the provided context. Would you like me to implement a fix for
this issue?
**superset/async_events/async_query_manager.py**
```
# Use a stable session/channel claim instead of the full token
message = json.dumps(
{
"user": token.get("user"),
"resources": token.get("resources"),
"session_id": token.get("session_id"),
},
sort_keys=True,
).encode("utf-8")
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
