gabotorresruiz commented on code in PR #45452:
URL: https://github.com/apache/superset/pull/45452#discussion_r4361718212
##########
superset/security/manager.py:
##########
@@ -6165,6 +6167,7 @@ def get_guest_user_from_request(self, req: Request) ->
Optional[GuestUser]:
token = self.parse_jwt_guest_token(raw_token)
if token.get("user") is None:
raise ValueError("Guest token does not contain a user claim")
+ validate_guest_token_identity(token["user"])
Review Comment:
Re-checked at `58f0eb3f23`: the pin survived, deleting this line still fails
`test_invalid_identity_rejected_through_request_flow[overlong]` and
`[trailing-newline]`. What changed is what it pins. Both cases now patch
`GUEST_TOKEN_IDENTITY_ENFORCE` on, so on the default configuration a 256
character `username` resolves to a guest rather than to the anonymous
principal, which is the opposite of what I closed this thread on. `UPDATING.md`
describes that correctly, so this is only a note that the conclusion here is
now conditional on the flag.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
