You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@superset.apache.org by "rusackas (via GitHub)" <gi...@apache.org> on 2026/05/12 20:34:54 UTC

Re: [PR] fix: the mcp service jwt verifier at superset/mcp_se... in... [superset]

rusackas commented on PR #39645:
URL: https://github.com/apache/superset/pull/39645#issuecomment-4434560081

   Approved CI 🤞 
   
   A couple things to note:
   
   1) No tests are added or updated. Security fixes like this should come with unit tests that explicitly verify the alg: none rejection and the missing-exp rejection.
   
   2) There's no mention of whether the underlying JWT library (python-jose / joserfc) already handles these cases — if it does, some of these checks may be redundant or even incorrect in edge cases.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org