GitHub user AbdullahTammar added a comment to the discussion: Offline Pure JWT Guest Token: Best practices for Secret generation, storage, and BFF vs Superset responsibility
Yes—direct signing in your BFF is an explicitly documented alternative in the [Embedded SDK README](https://github.com/apache/superset/tree/master/superset-embedded-sdk#creating-a-guest-token). For the default **HS256** configuration: - **Responsibility:** the BFF authenticates the portal user, authorizes the dashboard and RLS scope, and signs the token. Superset verifies it and enforces the resulting guest access. Never let Angular choose arbitrary dashboard IDs or RLS SQL for the BFF to sign. - **Shared secret:** both services need the same secret bytes: Superset through `GUEST_TOKEN_JWT_SECRET`, the BFF through its signing configuration. The Angular bundle must never receive this secret. It receives only the short-lived guest token. - **Generation:** `openssl rand -hex 32` produces 32 random bytes encoded as 64 hex characters, which is a suitable high-entropy secret for HS256. Hex is an encoding choice, not a required Superset format. If Superset uses that hex text as its secret, Node must use the same text; don't decode it with `Buffer.from(value, 'hex')` on only one side. Generate independent secrets for QA, UAT and production. - **Storage:** a managed secret store with narrowly scoped service access is a sensible deployment pattern. Load the secret into both server processes without putting it in source control, browser configuration or logs. Coordinate rotation across both services; replacing the verification secret invalidates tokens signed with the old one. Also match `GUEST_TOKEN_JWT_ALGO` and `GUEST_TOKEN_JWT_AUDIENCE`. The direct JWT uses **`rls_rules`**, whereas the guest-token issuance API accepts **`rls`**. Follow the documented claims, including `type: "guest"`, `resources`, `user`, `iat`, `exp` and `aud`. Set a short lifetime explicitly in the BFF: Superset's `GUEST_TOKEN_JWT_EXP_SECONDS` controls its own issuer, not the expiration your BFF writes. The current [configuration](https://github.com/apache/superset/blob/master/superset/config.py) and [security manager](https://github.com/apache/superset/blob/master/superset/security/manager.py) show the signing/verification settings. Check them against your deployed release, especially if you enable additional guest-token validation or revocation settings. *AI-generated; checked against the linked official documentation and source, not tested against your deployment.* GitHub link: https://github.com/apache/superset/discussions/45444#discussioncomment-19034655 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
