You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "dosubot[bot] (via GitHub)" <gi...@apache.org> on 2026/05/02 03:15:14 UTC
Re: [D] Problem in guest-token [superset]
GitHub user dosubot[bot] edited a comment on the discussion: Problem in guest-token
<!-- Answer -->
The **405 Method Not Allowed** error when generating guest tokens typically occurs due to one of these issues:
1. **Wrong HTTP method** - The `/api/v1/security/guest_token/` endpoint requires a **POST** request, not GET.
2. **Missing CSRF token** - You need to [fetch a CSRF token first and include it in your request](https://github.com/apache/superset/discussions/35670):
```python
# First, get CSRF token
csrf_response = requests.get(
f"{SUPERSET_URL}/api/v1/security/csrf_token/",
headers={"Authorization": f"Bearer {access_token}"}
)
csrf_token = csrf_response.json()["result"]
# Then use it in the guest token POST request
guest_token_response = requests.post(
f"{SUPERSET_URL}/api/v1/security/guest_token/",
headers={
"Authorization": f"Bearer {access_token}",
"X-CSRFToken": csrf_token,
"Content-Type": "application/json"
},
json={
"user": {"username": "guest", "first_name": "Guest", "last_name": "User"},
"resources": [{"type": "dashboard", "id": "YOUR_DASHBOARD_UUID"}],
"rls_rules": []
}
)
```
3. **Permissions** - Ensure the user making the request has the [`can_grant_guest_token` permission on `SecurityRestApi`](https://github.com/apache/superset/discussions/33674).
For development only, you can disable CSRF protection for this endpoint by adding to `superset_config.py`:
```python
WTF_CSRF_EXEMPT_LIST = ['superset.security.api.guest_token']
```
Can you share how you're making the request (HTTP method, headers, and endpoint URL)?
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=c991379f-540a-4abd-9396-089eb83f5225) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/38444#discussioncomment-16009841
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org