You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "tuan-h (via GitHub)" <gi...@apache.org> on 2024/05/13 09:49:29 UTC
[I] exp claim on JWT token is not respected and token is still valid after expiration time [superset]
tuan-h opened a new issue, #28450:
URL: https://github.com/apache/superset/issues/28450
### Bug description
Using my Superset secret key, I generated a JWT token for API access. The `exp` claim is not respected.
From terminal:
```
❯ date +%s
1715592489 # note that this is bigger than exp claim in above screenshot
❯ curl -X 'GET' \
'https://superset.xxx.com/api/v1/dataset/' \
-H 'accept: application/json' \
-H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
{"count":2, ...} # curl should have returned that token has already expired
```
Just as a sanity check, I added the `nbf` claim and it is respected.
```
❯ curl -X 'GET' \ 18:28:09
'https://superset.xxx.com/api/v1/dataset/' \
-H 'accept: application/json' \
-H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...with_nbf'
{"msg":"The token is not yet valid (nbf)"}
```
### How to reproduce the bug
1. Have a running instance of Superset.
2. Generate a JWT token with `sub`, `iat`, and `exp` claims. `exp` should be expired and `sub` should be a user id from `ab_user` table with access to API calls (admin user works fine). https://jwt.io/ can be used for token generation.
3. Run `curl` command from terminal with header `Authorization: Bearer {jwt_token}` as in above bug description.
4. `curl` should return response that token has already expired but it returns actual results instead
### Screenshots/recordings
_No response_
### Superset version
4.0.0
### Python version
Not applicable
### Node version
Not applicable
### Browser
Chrome
### Additional context
_No response_
### Checklist
- [X] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [X] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [X] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] exp claim on JWT token is not respected and token is still valid after expiration time [superset]
Posted by "dpgaspar (via GitHub)" <gi...@apache.org>.
dpgaspar commented on issue #28450:
URL: https://github.com/apache/superset/issues/28450#issuecomment-2107488942
I was not able to reproduce the issue
JWT used:
``` json
{
"fresh": true,
"iat": 1715600519,
"jti": "0072e7d4-cfc1-4ca3-a910-2b66fd957ea8",
"type": "access",
"sub": 1,
"nbf": 1715600519,
"exp": 1715601419
}
```
```
curl -X 'GET' \
'http://localhost:8088/api/v1/dataset/' \
-H 'accept: application/json' \
-H 'Authorization: Bearer eyJhbGci....'
{
"msg": "Token has expired"
}
$ date +%s
1715604341
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] exp claim on JWT token is not respected and token is still valid after expiration time [superset]
Posted by "tuan-h (via GitHub)" <gi...@apache.org>.
tuan-h closed issue #28450: exp claim on JWT token is not respected and token is still valid after expiration time
URL: https://github.com/apache/superset/issues/28450
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] exp claim on JWT token is not respected and token is still valid after expiration time [superset]
Posted by "tuan-h (via GitHub)" <gi...@apache.org>.
tuan-h commented on issue #28450:
URL: https://github.com/apache/superset/issues/28450#issuecomment-2109159732
This was my mistake. The timestamp I used was in milliseconds when it should have been in seconds. So the expiration was off by orders of magnitude. Thank you for the assistance! Closing the issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] exp claim on JWT token is not respected and token is still valid after expiration time [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #28450:
URL: https://github.com/apache/superset/issues/28450#issuecomment-2107132054
<!-- Greeting -->
Hey there, @tuan-h! 🚀 I'm [Dosu](https://dosu.dev), a bot here to lend a hand with bugs, answer your queries, and guide you through contributions while we wait for a human maintainer to chime in. Think of me as your go-to assistant in the meantime! 🤖
I've got your issue on my radar and I'm diving into it now. Expect to hear back with some insights or guidance shortly!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org