fitzee opened a new pull request, #43944:
URL: https://github.com/apache/superset/pull/43944
### SUMMARY
Add opt-in, size-only diagnostics for guest tokens that may exceed a
deployment's request-header budget. A successful token mint does not guarantee
a subsequent authentication request can pass through a proxy.
- Extend the existing upstream issuance audit with encoded token bytes,
calculated header bytes, configured budget, and exceeded flag; warn with size
metadata only.
- Measure initial/refreshed embedded tokens using the configured header
name. On authentication failure, offer a targeted payload-reduction suggestion
only with oversized-token evidence and HTTP 400/431 or an unavailable status.
Other failures remain generic; HTTP 400 alone is not treated as proof.
- Snapshot metadata at request dispatch and suppress ambiguous attribution
when a refresh occurs in flight. Preserve issuance HTTP 200, token bytes,
response shape, authentication requests, started guard, and retries. No
preflight blocking, authorization/RLS changes, or transport redesign.
- Stop logging raw authentication errors and credential-bearing Switchboard
message bodies. New diagnostics contain no JWTs, decoded claims, RLS SQL, or
raw headers.
Based directly on Apache master 87f138cc80ac9de3a3fcee082c41ba2368be8186.
This extends the audit helper already present in that base; it does not
introduce audit/revocation features or unrelated documentation/dependency
repairs.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
No browser screenshots available locally.
Before: generic authentication failure with raw error logging.
After, only with size evidence: “Embedded authentication failed. The guest
token may exceed the request-header size limit. Reduce the token payload; large
inline RLS lists can be replaced with an entitlements-table lookup.”
### TESTING INSTRUCTIONS
Focused coverage includes below/at/above boundaries, UTF-8/custom-header
accounting, disabled budgets, privacy, unchanged issuance response/status,
bootstrap config, non-JSON proxy errors, unrelated authentication errors,
oversized refresh, stale request attribution, and existing retry/start behavior.
Run in a configured development environment:
pytest tests/unit_tests/security/guest_token_audit_test.py
tests/integration_tests/embedded/test_view.py -q
cd superset-frontend
npm run test -- src/embedded/guestTokenDiagnostics.test.ts
src/embedded/index.test.tsx --maxWorkers=2
Local validation:
- Ten isolated Python source smoke cases and TypeScript source
boundary/privacy/message checks pass. These use extraction/stubs and do not
replace pytest, Jest, route/decorator tests, or browser tests.
- Repository pytest is blocked during conftest import by missing paramiko.
- Repository Jest is blocked by missing cross-env; frontend dependencies are
not installed.
- Pre-commit formatting, mypy, ruff, oxlint, basic checks, and feature-flag
sync pass. Frontend custom rules/stylelint/type checking are blocked by missing
glob, postcss-styled-syntax, and tscw-config. Post-commit pylint is blocked
because pylint is not installed.
- Local application health endpoint is unavailable. No browser, staging, or
real-proxy acceptance-boundary verification is claimed.
Manual verification:
1. Set GUEST_TOKEN_HEADER_MAX_BYTES to a deployment-specific positive
integer and reload the iframe.
2. Mint below/at/above the diagnostic budget; verify unchanged successful
issuance and size-only metadata/warnings.
3. Exercise normal embedding, an oversized proxy-rejected authentication
request (including HTML), unrelated errors, refresh after startup, and refresh
while authentication is pending.
4. Verify bootstrap configuration and credential-free diagnostics. Validate
the actual proxy path separately; unit-test boundaries do not establish exact
proxy acceptance boundaries.
### ADDITIONAL INFORMATION
GUEST_TOKEN_HEADER_MAX_BYTES defaults to None (disabled), not a universal
proxy policy. Configure it in superset_config.py to activate budget warnings
and targeted messaging.
Accounting is UTF-8 bytes of header name, colon-space, encoded token, and
CRLF (four framing bytes). Warn only when strictly greater than the budget;
equality does not warn. Zero/negative values disable warnings. This is
diagnostic accounting, not a guarantee about HTTP/2 compression, total-header
limits, or every proxy's interpretation.
[AWS documents a non-adjustable 16 K single-header
limit](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-limits.html).
Changing a diagnostic budget does not raise transport limits or add
large-token support. Entitlements-table substitutions must preserve row
restrictions and be tested for equivalent access and performance.
- [ ] Has associated issue:
- [ ] Required feature flags:
- [x] Changes UI
- [ ] Includes DB Migration
- [x] Introduces new feature or API: opt-in diagnostics configuration
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
