You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "JishnuJsm (via GitHub)" <gi...@apache.org> on 2025/05/27 05:20:50 UTC
[D] Superset API Auth Issue (Expecting cookies instead of access_token) [superset]
GitHub user JishnuJsm created a discussion: Superset API Auth Issue (Expecting cookies instead of access_token)
I have been working with a new dashboard page where I'm listing all the dashboards in Superset. So, for fetching the dashboard, I used /api/v1/dashboard endpoint. The endpoint has some issues when I call it like this
curl --location 'http://localhost:8088/api/v1/dashboard/'
1) It is just returning the publicly accessible dashboards
It returns all dashboards only when I call like this
curl --location 'http://localhost:8088/api/v1/dashboard/' \
--header 'Cookie: session=....'
But here, there is no use of the access token.
Also, I have noted an issue that happens only when the public role has been set for some dashboard access
If the Public role does nothave access to the dashboard, then the same endpoint gets data using a Bearer token
GitHub link: https://github.com/apache/superset/discussions/33585
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset API Auth Issue (Expecting cookies instead of access_token) [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Superset API Auth Issue (Expecting cookies instead of access_token)
<!-- Answer -->
It is not possible to apply a specific role directly as part of the API request to /api/v1/dashboard in Superset. Roles and permissions in Superset are managed through user authentication—when you authenticate (using a session cookie or supported token), the API determines your access based on the roles assigned to your user account. There is no supported mechanism to specify or override a role in the API request itself.
The DashboardRestApi class that handles this endpoint uses authentication decorators (like @protect()), which enforce access control based on the authenticated user's roles and permissions. The API does allow filtering dashboards by role in queries, but this only works for dashboards that have been assigned to those roles—it does not change the permissions of the requesting user or impersonate another role [[source]](https://github.com/apache/superset/blob/master/superset/dashboards/api.py).
If you need to access dashboards as a user with a specific role, you must authenticate as a user who has that role assigned. There is no API parameter or header to "apply" a different role for a single request.
If you have a use case that requires dynamic role switching, you would need to manage this at the user/session level, not per API call.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=159efde7-37f4-4cb9-b950-4b978164a276) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/33585#discussioncomment-13279516
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset API Auth Issue (Expecting cookies instead of access_token) [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Superset API Auth Issue (Expecting cookies instead of access_token)
<!-- Answer -->
The behavior you're seeing with the Superset `/api/v1/dashboard` endpoint is consistent with how authentication and permissions are implemented in Superset:
- When you call the endpoint without authentication, you only get dashboards accessible to the "Public" role.
- When you use a session cookie (from a logged-in browser session), you get all dashboards your user account has permission to see.
- The API does not always accept a Bearer access token for all endpoints or authentication flows, depending on how Superset is configured and how the token is generated.
### Why is the API expecting cookies instead of an access token?
Superset's REST API endpoints, including `/api/v1/dashboard`, are protected by authentication decorators (such as `@protect()`), which by default expect a session-based authentication (i.e., a session cookie) for most use cases. This is why using a session cookie works for accessing all dashboards, while unauthenticated requests only return dashboards available to the "Public" role [[source]](https://github.com/apache/superset/blob/master/superset/dashboards/api.py).
There is a known issue where some API endpoints only work with cookies for authentication, and using Bearer tokens does not provide the same access. This has been reported by other users as well, but there is currently no official solution or workaround documented in the repository [[source]](https://github.com/apache/superset/issues/23352).
### Public Role and Access
If the "Public" role is granted access to certain dashboards, unauthenticated requests will return those dashboards. If the "Public" role does not have access, you must authenticate as a user with the necessary permissions to see more dashboards. This is by design and aligns with Superset's security model [[source]](https://github.com/apache/superset/blob/master/docs/docs/security/security.mdx).
You can configure the permissions of the "Public" role using the `PUBLIC_ROLE_LIKE` setting in your `superset_config.py`. For example, setting `PUBLIC_ROLE_LIKE = "Gamma"` will grant the "Public" role the same permissions as the Gamma role, but you still need to explicitly grant access to specific datasets [[source]](https://github.com/apache/superset/discussions/31949).
### How to Properly Authenticate API Requests
- For full access to dashboards via the API, use a session cookie from a logged-in user session.
- If you want to use access tokens, ensure they are generated and used in a way that Superset recognizes (e.g., via OAuth or JWT, if configured). However, not all endpoints may support Bearer token authentication out of the box.
- For public/anonymous access, configure the "Public" role and its permissions as needed.
### Summary
- The API's reliance on cookies is by design for most endpoints.
- Bearer token support may be limited or require additional configuration.
- Public dashboards are controlled by the "Public" role's permissions.
- There are open issues about this authentication behavior, but no official fix yet [[source]](https://github.com/apache/superset/issues/23352).
If you need to automate dashboard access, the most reliable method is to authenticate as a user and use the session cookie in your API requests. If you need broader API token support, you may need to explore Superset's advanced authentication options or monitor related issues for updates.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=06db5c52-2e60-498c-bbb9-95bf6f44bd3d) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/33585#discussioncomment-13278652
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset API Auth Issue (Expecting cookies instead of access_token) [superset]
Posted by "JishnuJsm (via GitHub)" <gi...@apache.org>.
GitHub user JishnuJsm added a comment to the discussion: Superset API Auth Issue (Expecting cookies instead of access_token)
@dosu Will I be able to apply a specific role along with the API request? (/api/v1/dashboard)
GitHub link: https://github.com/apache/superset/discussions/33585#discussioncomment-13279497
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset API Auth Issue (Expecting cookies instead of access_token) [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Superset API Auth Issue (Expecting cookies instead of access_token)
<!-- Answer -->
The /api/v1/dashboard endpoint returns only 20 results by default because of the FAB_API_MAX_PAGE_SIZE configuration setting in Superset. This limit is in place to prevent excessive data load on the API. Even if you use pagination parameters like ?page=0&page_size=100, you will still only get up to 20 results unless this setting is changed. To retrieve more dashboards, you need to increase the FAB_API_MAX_PAGE_SIZE value in your Superset configuration (for example, set FAB_API_MAX_PAGE_SIZE = 1000) [[source](https://github.com/apache/superset/issues/23352)].
Regarding pagination data: the API response does not include explicit pagination metadata by default, and the OpenAPI spec does not document pagination parameters for this endpoint [[source](https://github.com/apache/superset/blob/master/docs/static/resources/openapi.json)]. This means you may not see fields like total count, current page, or total pages in the response.
**Summary of what you can do:**
- To get more than 20 dashboards, set FAB_API_MAX_PAGE_SIZE in your superset_config.py and restart Superset.
- If you want to implement pagination, you can use the page and page_size query parameters, but the maximum number of results per page will be capped by FAB_API_MAX_PAGE_SIZE.
- The API response may not include pagination metadata, so you may need to handle pagination logic on the client side.
If you need more details on how to set FAB_API_MAX_PAGE_SIZE or handle pagination, let me know!
<!-- Dosu Comment Footer -->
*To reply, just mention my name [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/8d168239-aca9-414b-8b6f-669a0c5db5b6?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/8d168239-aca9-414b-8b6f-669a0c5db5b6?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/8d168239-aca9-414b-8b6f-669a0c5db5b6?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/8d168239-aca9-414b-8b6f-669a0c5db5b6?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/8d168239-aca9-414b-8b6f-669a0c5db5b6?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/8d168239-aca9-414b-8b6f-669a0c5db5b6?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/8d168239-aca9-414b-8b6f-669a0c5db5b6?feedback_type=other)</sup> [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/33585)
GitHub link: https://github.com/apache/superset/discussions/33585#discussioncomment-13280173
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset API Auth Issue (Expecting cookies instead of access_token) [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Superset API Auth Issue (Expecting cookies instead of access_token)
<!-- Answer -->
The behavior you're seeing with the Superset `/api/v1/dashboard` endpoint is consistent with how authentication and permissions are implemented in Superset:
- When you call the endpoint without authentication, you only get dashboards accessible to the "Public" role.
- When you use a session cookie (from a logged-in browser session), you get all dashboards your user account has permission to see.
- The API does not always accept a Bearer access token for all endpoints or authentication flows, depending on how Superset is configured and how the token is generated.
### Why is the API expecting cookies instead of an access token?
Superset's REST API endpoints, including `/api/v1/dashboard`, are protected by authentication decorators (such as `@protect()`), which by default expect a session-based authentication (i.e., a session cookie) for most use cases. This is why using a session cookie works for accessing all dashboards, while unauthenticated requests only return dashboards available to the "Public" role [[source]](https://github.com/apache/superset/blob/master/superset/dashboards/api.py).
There is a known issue where some API endpoints only work with cookies for authentication, and using Bearer tokens does not provide the same access. This has been reported by other users as well, but there is currently no official solution or workaround documented in the repository [[source]](https://github.com/apache/superset/issues/23352).
### Public Role and Access
If the "Public" role is granted access to certain dashboards, unauthenticated requests will return those dashboards. If the "Public" role does not have access, you must authenticate as a user with the necessary permissions to see more dashboards. This is by design and aligns with Superset's security model [[source]](https://github.com/apache/superset/blob/master/docs/docs/security/security.mdx).
You can configure the permissions of the "Public" role using the `PUBLIC_ROLE_LIKE` setting in your `superset_config.py`. For example, setting `PUBLIC_ROLE_LIKE = "Gamma"` will grant the "Public" role the same permissions as the Gamma role, but you still need to explicitly grant access to specific datasets [[source]](https://github.com/apache/superset/discussions/31949).
### How to Properly Authenticate API Requests
- For full access to dashboards via the API, use a session cookie from a logged-in user session.
- If you want to use access tokens, ensure they are generated and used in a way that Superset recognizes (e.g., via OAuth or JWT, if configured). However, not all endpoints may support Bearer token authentication out of the box.
- For public/anonymous access, configure the "Public" role and its permissions as needed.
### Summary
- The API's reliance on cookies is by design for most endpoints.
- Bearer token support may be limited or require additional configuration.
- Public dashboards are controlled by the "Public" role's permissions.
- There are open issues about this authentication behavior, but no official fix yet [[source]](https://github.com/apache/superset/issues/23352).
If you need to automate dashboard access, the most reliable method is to authenticate as a user and use the session cookie in your API requests. If you need broader API token support, you may need to explore Superset's advanced authentication options or monitor related issues for updates.
<!-- Dosu Comment Footer -->
*To reply, just mention my name [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/06db5c52-2e60-498c-bbb9-95bf6f44bd3d?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/06db5c52-2e60-498c-bbb9-95bf6f44bd3d?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/06db5c52-2e60-498c-bbb9-95bf6f44bd3d?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/06db5c52-2e60-498c-bbb9-95bf6f44bd3d?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/06db5c52-2e60-498c-bbb9-95bf6f44bd3d?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/06db5c52-2e60-498c-bbb9-95bf6f44bd3d?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/06db5c52-2e60-498c-bbb9-95bf6f44bd3d?feedback_type=other)</sup> [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/33585)
GitHub link: https://github.com/apache/superset/discussions/33585#discussioncomment-13278652
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset API Auth Issue (Expecting cookies instead of access_token) [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Superset API Auth Issue (Expecting cookies instead of access_token)
<!-- Answer -->
The /api/v1/dashboard endpoint returns only 20 results by default because of the FAB_API_MAX_PAGE_SIZE configuration setting in Superset. This limit is in place to prevent excessive data load on the API. Even if you use pagination parameters like ?page=0&page_size=100, you will still only get up to 20 results unless this setting is changed. To retrieve more dashboards, you need to increase the FAB_API_MAX_PAGE_SIZE value in your Superset configuration (for example, set FAB_API_MAX_PAGE_SIZE = 1000) [[source](https://github.com/apache/superset/issues/23352)].
Regarding pagination data: the API response does not include explicit pagination metadata by default, and the OpenAPI spec does not document pagination parameters for this endpoint [[source](https://github.com/apache/superset/blob/master/docs/static/resources/openapi.json)]. This means you may not see fields like total count, current page, or total pages in the response.
**Summary of what you can do:**
- To get more than 20 dashboards, set FAB_API_MAX_PAGE_SIZE in your superset_config.py and restart Superset.
- If you want to implement pagination, you can use the page and page_size query parameters, but the maximum number of results per page will be capped by FAB_API_MAX_PAGE_SIZE.
- The API response may not include pagination metadata, so you may need to handle pagination logic on the client side.
If you need more details on how to set FAB_API_MAX_PAGE_SIZE or handle pagination, let me know!
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=8d168239-aca9-414b-8b6f-669a0c5db5b6) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/33585#discussioncomment-13280173
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset API Auth Issue (Expecting cookies instead of access_token) [superset]
Posted by "JishnuJsm (via GitHub)" <gi...@apache.org>.
GitHub user JishnuJsm added a comment to the discussion: Superset API Auth Issue (Expecting cookies instead of access_token)
@dosu Got it, also /api/v1/dashboard endpoint was returning only 20results, also not pagination data were added?
GitHub link: https://github.com/apache/superset/discussions/33585#discussioncomment-13280143
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset API Auth Issue (Expecting cookies instead of access_token) [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] edited a comment on the discussion: Superset API Auth Issue (Expecting cookies instead of access_token)
<!-- Answer -->
You cannot obtain a session cookie directly via the /v1/security/login API endpoint. This endpoint is designed to return JWT access and refresh tokens, not browser session cookies, which is why you do not see a Set-Cookie header in the response when calling it programmatically. This is a known limitation and has been discussed in the community, but there is currently no official solution or workaround for obtaining session cookies through this API endpoint alone [reference](https://github.com/apache/superset/issues/13907).
If you need to make authenticated API requests (such as to /api/v1/dashboard) that require a session cookie, you have two main options:
1. **Login via the Web UI:** Logging in through the Superset web interface will set the session cookie in your browser, which you can then use for subsequent API requests.
2. **Programmatically Obtain CSRF Token and Cookie:** Superset provides a dedicated API endpoint to obtain the CSRF token and the necessary cookie headers for API calls. You can find this endpoint by searching for 'csrf' in the Superset API documentation. This approach is used to programmatically get the CSRF token and the associated cookies required for authenticated requests [reference](https://github.com/apache/superset/issues/32315).
**Summary:**
- /v1/security/login returns JWT tokens, not session cookies.
- Session cookies are only set via the web login flow.
- For programmatic access, use the CSRF token endpoint to get the required cookies for API calls.
If you need to automate dashboard access and bearer tokens are not working for your use case, using the CSRF token endpoint to obtain the necessary cookies is currently the best available method. There is no supported way to get a session cookie directly from /v1/security/login.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Share context across your team and agents. Try [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-feedback&utm_term=apache%2Fsuperset&message_id=5a918f58-7941-425b-bc2e-cb4ff44064e0) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-learn-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=knowledge-infrastructure-add-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/33585#discussioncomment-13279706
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset API Auth Issue (Expecting cookies instead of access_token) [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Superset API Auth Issue (Expecting cookies instead of access_token)
<!-- Answer -->
It is not possible to apply a specific role directly as part of the API request to /api/v1/dashboard in Superset. Roles and permissions in Superset are managed through user authentication—when you authenticate (using a session cookie or supported token), the API determines your access based on the roles assigned to your user account. There is no supported mechanism to specify or override a role in the API request itself.
The DashboardRestApi class that handles this endpoint uses authentication decorators (like @protect()), which enforce access control based on the authenticated user's roles and permissions. The API does allow filtering dashboards by role in queries, but this only works for dashboards that have been assigned to those roles—it does not change the permissions of the requesting user or impersonate another role [[source]](https://github.com/apache/superset/blob/master/superset/dashboards/api.py).
If you need to access dashboards as a user with a specific role, you must authenticate as a user who has that role assigned. There is no API parameter or header to "apply" a different role for a single request.
If you have a use case that requires dynamic role switching, you would need to manage this at the user/session level, not per API call.
<!-- Dosu Comment Footer -->
*To reply, just mention my name [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/159efde7-37f4-4cb9-b950-4b978164a276?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/159efde7-37f4-4cb9-b950-4b978164a276?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/159efde7-37f4-4cb9-b950-4b978164a276?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/159efde7-37f4-4cb9-b950-4b978164a276?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/159efde7-37f4-4cb9-b950-4b978164a276?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/159efde7-37f4-4cb9-b950-4b978164a276?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/159efde7-37f4-4cb9-b950-4b978164a276?feedback_type=other)</sup> [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/33585)
GitHub link: https://github.com/apache/superset/discussions/33585#discussioncomment-13279516
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset API Auth Issue (Expecting cookies instead of access_token) [superset]
Posted by "JishnuJsm (via GitHub)" <gi...@apache.org>.
GitHub user JishnuJsm added a comment to the discussion: Superset API Auth Issue (Expecting cookies instead of access_token)
@dosu Done, how can i able to get the session cookies through API /v1/security/login
This superset was only returning the Set-Cookie header if the user logged in using the GUI. If we use /v1/security/login, no cookies are returned. Then how can I able to use a cookie in the /api/v1/dashboard enpoint to fetch all dashboard since bearer token was not working when public roles have "can read dashboard" access.
GitHub link: https://github.com/apache/superset/discussions/33585#discussioncomment-13279683
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Superset API Auth Issue (Expecting cookies instead of access_token) [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
GitHub user dosubot[bot] added a comment to the discussion: Superset API Auth Issue (Expecting cookies instead of access_token)
<!-- Answer -->
You cannot obtain a session cookie directly via the /v1/security/login API endpoint. This endpoint is designed to return JWT access and refresh tokens, not browser session cookies, which is why you do not see a Set-Cookie header in the response when calling it programmatically. This is a known limitation and has been discussed in the community, but there is currently no official solution or workaround for obtaining session cookies through this API endpoint alone [reference](https://github.com/apache/superset/issues/13907).
If you need to make authenticated API requests (such as to /api/v1/dashboard) that require a session cookie, you have two main options:
1. **Login via the Web UI:** Logging in through the Superset web interface will set the session cookie in your browser, which you can then use for subsequent API requests.
2. **Programmatically Obtain CSRF Token and Cookie:** Superset provides a dedicated API endpoint to obtain the CSRF token and the necessary cookie headers for API calls. You can find this endpoint by searching for 'csrf' in the Superset API documentation. This approach is used to programmatically get the CSRF token and the associated cookies required for authenticated requests [reference](https://github.com/apache/superset/issues/32315).
**Summary:**
- /v1/security/login returns JWT tokens, not session cookies.
- Session cookies are only set via the web login flow.
- For programmatic access, use the CSRF token endpoint to get the required cookies for API calls.
If you need to automate dashboard access and bearer tokens are not working for your use case, using the CSRF token endpoint to obtain the necessary cookies is currently the best available method. There is no supported way to get a session cookie directly from /v1/security/login.
<!-- Dosu Comment Footer -->
*To reply, just mention my name [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do? [Good](https://app.dosu.dev/response-feedback/5a918f58-7941-425b-bc2e-cb4ff44064e0?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/5a918f58-7941-425b-bc2e-cb4ff44064e0?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/5a918f58-7941-425b-bc2e-cb4ff44064e0?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/5a918f58-7941-425b-bc2e-cb4ff44064e0?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/5a918f58-7941-425b-bc2e-cb4ff44064e0?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/5a918f58-7941-425b-bc2e-cb4ff44064e0?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/5a918f58-7941-425b-bc2e-cb4ff44064e0?feedback_type=other)</sup> [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/33585)
GitHub link: https://github.com/apache/superset/discussions/33585#discussioncomment-13279706
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org