GitHub user Darshan-S-2002 created a discussion: Offline Pure JWT Guest Token: Best practices for Secret generation, storage, and BFF vs Superset responsibility
Hi Superset Community, We are embedding Superset dashboards into an Angular portal using @superset-ui/embedded-sdk and the offline Pure JWT Guest Token approach (GUEST_TOKEN_JWT_SECRET). Our application backend (BFF in Node.js) generates the guest tokens to enforce user-specific Row Level Security (RLS) without slow REST API calls. We would appreciate clarification on standard best practices: Role Division: Is it standard practice for the application backend (BFF) to mint and cryptographically sign the guest token, while Superset only acts as the verifier? Secret Configuration: Does GUEST_TOKEN_JWT_SECRET strictly need to be configured in both the Superset instance (superset_config.py) and the application backend (BFF)? Secret Generation: Is a 256-bit CSPRNG hex string (openssl rand -hex 32) the recommended format for this secret, and should each environment (QA, UAT, Prod) have a unique secret? Vault Storage: In cloud deployments, is storing this secret in a vault (e.g., Azure Key Vault / AWS Secrets Manager) and injecting it into both Superset and the BFF the recommended pattern? Thanks for your guidance! GitHub link: https://github.com/apache/superset/discussions/45444 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
