You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "17Shristi (via GitHub)" <gi...@apache.org> on 2025/08/18 17:12:29 UTC
[D] CSRF Session token is missing [superset]
GitHub user 17Shristi created a discussion: CSRF Session token is missing
I am trying to embed a dashboard on client facing UI. Earlier it was working fine, but we upgraded to 5.0.0. after which we are getting this error:
Error generating embed token: {
[1] errors: [
[1] {
[1] message: '400 Bad Request: The CSRF session token is missing.',
[1] error_type: 'GENERIC_BACKEND_ERROR',
[1] level: 'error',
[1] extra: [Object]
[1] }
[1] ]
[1] }
we are passing X-CSRFToken
method: 'post',
maxBodyLength: Infinity,
url: `localhost:8088/api/v1/security/guest_token`,
headers: {
Cookie: `${cookies}`,
'X-CSRFToken': csrfToken,
Authorization: `Bearer ${accessToken}`,
'Content-Type': 'application/json',
},
withCredentials: true,
data: data,
Using this end point to get the csrf token:
const response = await axios.get(
`localhost:8088/api/v1/security/csrf_token/`,
{
headers: {
'Content-Type': 'application/json',
Authorization: `Bearer ${accessToken}`,
},
},
);
const cookies = response.headers['set-cookie'];
what is I am missing?
GitHub link: https://github.com/apache/superset/discussions/34738
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] CSRF Session token is missing [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: CSRF Session token is missing
<!-- Answer -->
The issue is with how you're passing cookies to the Cookie header. Superset expects the Cookie header to be a single string of key=value pairs, not an array or the full set-cookie strings. You need to extract just the session cookie value and format it like this:
```js
// Example: extract the session cookie from set-cookie array
const sessionCookie = cookies
.map(c => c.split(';')[0])
.find(c => c.startsWith('session='));
// Then use:
headers: {
Cookie: sessionCookie, // e.g. 'session=.e,......'
'X-CSRFToken': csrfToken,
Authorization: `Bearer ${accessToken}`,
'Content-Type': 'application/json',
}
```
If you need to send multiple cookies, join them with `; ` (semicolon and space), like `'session=...; async-token=...'`. But for CSRF/session validation, the session cookie is required and must match the CSRF token you received. Passing the whole array or the full set-cookie strings will cause validation to fail [see code reference](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/security/api.py).
Let me know if you're running this in a browser or Node.js—handling HttpOnly cookies is different in each environment.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=ba788581-fb39-4a0c-a3fe-7a7f165a91bd) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/34738#discussioncomment-14144017
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] CSRF Session token is missing [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: CSRF Session token is missing
<!-- Answer -->
Superset 5.0.0 enforces CSRF protection on the /api/v1/security/guest_token endpoint, so both a valid CSRF token and the session cookie must be included in your POST request. The CSRF token you get from /api/v1/security/csrf_token/ is tied to the session cookie set in the response. When making the POST to /guest_token, you need to send both the X-CSRFToken header and the session cookie together—if either is missing or mismatched, you'll get the "CSRF session token is missing" error. This is stricter than some previous versions, where session handling might have been more lenient.
Make sure your flow is: fetch the CSRF token, extract the session cookie from the Set-Cookie header, and then include both in your POST request to /guest_token (withCredentials: true, X-CSRFToken header, and the session cookie in the Cookie header). If you want to disable CSRF for testing, you can set WTF_CSRF_ENABLED = False in your config, but this is not recommended for production. For more details, see the relevant code and config references [here](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/security/api.py) and [here](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py).
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/5ceb1690-cb04-4395-8b14-5f837fb7ce95?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/5ceb1690-cb04-4395-8b14-5f837fb7ce95?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/5ceb1690-cb04-4395-8b14-5f837fb7ce95?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/5ceb1690-cb04-4395-8b14-5f837fb7ce95?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/5ceb1690-cb04-4395-8b14-5f837fb7ce95?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/5ceb1690-cb04-4395-8b14-5f837fb7ce95?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/5ceb1690-cb04-4395-8b14-5f837fb7ce95?feedback_type=other)</sup> [](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github)&
nbsp;[](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/34738)
GitHub link: https://github.com/apache/superset/discussions/34738#discussioncomment-14143875
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] CSRF Session token is missing [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: CSRF Session token is missing
<!-- Answer -->
Superset 5.0.0 enforces CSRF protection on the /api/v1/security/guest_token endpoint, so both a valid CSRF token and the session cookie must be included in your POST request. The CSRF token you get from /api/v1/security/csrf_token/ is tied to the session cookie set in the response. When making the POST to /guest_token, you need to send both the X-CSRFToken header and the session cookie together—if either is missing or mismatched, you'll get the "CSRF session token is missing" error. This is stricter than some previous versions, where session handling might have been more lenient.
Make sure your flow is: fetch the CSRF token, extract the session cookie from the Set-Cookie header, and then include both in your POST request to /guest_token (withCredentials: true, X-CSRFToken header, and the session cookie in the Cookie header). If you want to disable CSRF for testing, you can set WTF_CSRF_ENABLED = False in your config, but this is not recommended for production. For more details, see the relevant code and config references [here](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/security/api.py) and [here](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/config.py).
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=5ceb1690-cb04-4395-8b14-5f837fb7ce95) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/34738#discussioncomment-14143875
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] CSRF Session token is missing [superset]
Posted by "17Shristi (via GitHub)" <gi...@apache.org>.
GitHub user 17Shristi added a comment to the discussion: CSRF Session token is missing
can you help @dosu
GitHub link: https://github.com/apache/superset/discussions/34738#discussioncomment-14143846
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] CSRF Session token is missing [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: CSRF Session token is missing
<!-- Answer -->
The issue is with how you're passing cookies to the Cookie header. Superset expects the Cookie header to be a single string of key=value pairs, not an array or the full set-cookie strings. You need to extract just the session cookie value and format it like this:
```js
// Example: extract the session cookie from set-cookie array
const sessionCookie = cookies
.map(c => c.split(';')[0])
.find(c => c.startsWith('session='));
// Then use:
headers: {
Cookie: sessionCookie, // e.g. 'session=.e,......'
'X-CSRFToken': csrfToken,
Authorization: `Bearer ${accessToken}`,
'Content-Type': 'application/json',
}
```
If you need to send multiple cookies, join them with `; ` (semicolon and space), like `'session=...; async-token=...'`. But for CSRF/session validation, the session cookie is required and must match the CSRF token you received. Passing the whole array or the full set-cookie strings will cause validation to fail [see code reference](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/security/api.py).
Let me know if you're running this in a browser or Node.js—handling HttpOnly cookies is different in each environment.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/ba788581-fb39-4a0c-a3fe-7a7f165a91bd?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/ba788581-fb39-4a0c-a3fe-7a7f165a91bd?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/ba788581-fb39-4a0c-a3fe-7a7f165a91bd?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/ba788581-fb39-4a0c-a3fe-7a7f165a91bd?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/ba788581-fb39-4a0c-a3fe-7a7f165a91bd?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/ba788581-fb39-4a0c-a3fe-7a7f165a91bd?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/ba788581-fb39-4a0c-a3fe-7a7f165a91bd?feedback_type=other)</sup> [](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github)&
nbsp;[](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/34738)
GitHub link: https://github.com/apache/superset/discussions/34738#discussioncomment-14144017
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] CSRF Session token is missing [superset]
Posted by "17Shristi (via GitHub)" <gi...@apache.org>.
GitHub user 17Shristi added a comment to the discussion: CSRF Session token is missing
const cookies = response.headers['set-cookie'];
On console.log cookies
this is what I am getting:
1] [
[1] 'async-token=ey....; HttpOnly; Path=/',
[1] 'session=.e,......; Secure; HttpOnly; Path=/; SameSite=None'
[1] ]
sample async token and session key value pairs, I am passing the whole cookie to this guest_token post request like this:
Cookie: `${cookies}`,
'X-CSRFToken': csrfToken,
@dosu
GitHub link: https://github.com/apache/superset/discussions/34738#discussioncomment-14143943
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] CSRF Session token is missing [superset]
Posted by "17Shristi (via GitHub)" <gi...@apache.org>.
GitHub user 17Shristi closed a discussion: CSRF Session token is missing
I am trying to embed a dashboard on client facing UI. Earlier it was working fine, but we upgraded to 5.0.0. after which we are getting this error:
Error generating embed token: {
[1] errors: [
[1] {
[1] message: '400 Bad Request: The CSRF session token is missing.',
[1] error_type: 'GENERIC_BACKEND_ERROR',
[1] level: 'error',
[1] extra: [Object]
[1] }
[1] ]
[1] }
we are passing X-CSRFToken
method: 'post',
maxBodyLength: Infinity,
url: `localhost:8088/api/v1/security/guest_token`,
headers: {
Cookie: `${cookies}`,
'X-CSRFToken': csrfToken,
Authorization: `Bearer ${accessToken}`,
'Content-Type': 'application/json',
},
withCredentials: true,
data: data,
Using this end point to get the csrf token:
const response = await axios.get(
`localhost:8088/api/v1/security/csrf_token/`,
{
headers: {
'Content-Type': 'application/json',
Authorization: `Bearer ${accessToken}`,
},
},
);
const cookies = response.headers['set-cookie'];
what is I am missing?
GitHub link: https://github.com/apache/superset/discussions/34738
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org