You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "dosubot[bot] (via GitHub)" <gi...@apache.org> on 2026/05/02 02:50:07 UTC
Re: [D] API returns empty dashboards/charts (count:0) after successful login on Superset 4.1.2 [superset]
GitHub user dosubot[bot] edited a comment on the discussion: API returns empty dashboards/charts (count:0) after successful login on Superset 4.1.2
<!-- Greeting -->
Hi @xokok! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the superset team.
<!-- Answer -->
This is a **known issue** in Superset 4.1.x. The `/api/v1/security/login` endpoint returns a JWT token but does **not** set the session cookies that many API endpoints require. Without the session cookie, the API silently returns empty results instead of a proper 401/403 error.
**The fix**: After login, you need to fetch a CSRF token, which will automatically set the necessary session cookies:
```python
def login(self):
url = self.base_url + '/security/login'
data = {
"password": "password",
"provider": "db",
"refresh": True,
"username": "apiuser"
}
headers = {"Content-Type": "application/json"}
resp = self.session.post(url, data=json.dumps(data), headers=headers, verify=False)
if resp.status_code == 200:
self.token = resp.json()['access_token']
print("login successful")
# IMPORTANT: Fetch CSRF token to establish session cookies
csrf_url = self.base_url + '/security/csrf_token/'
csrf_headers = {
"Authorization": "Bearer " + self.token,
"Content-Type": "application/json"
}
csrf_resp = self.session.get(csrf_url, headers=csrf_headers, verify=False)
if csrf_resp.status_code == 200:
self.csrf_token = csrf_resp.json()['result']
print("CSRF token obtained, session established")
def get_all_dashboards(self):
if not self.token:
self.login()
url = self.base_url + '/dashboard/'
headers = {
"Authorization": "Bearer " + self.token,
"Content-Type": "application/json",
"X-CSRFToken": self.csrf_token # Include CSRF token
}
resp = self.session.get(url, headers=headers, verify=False)
print("response status:", resp.status_code)
print("response data:", resp.text)
```
Key points:
1. Use `requests.Session()` (which you already do) to let it manage cookies automatically
2. Call `/api/v1/security/csrf_token/` after login to establish the session
3. Include the `X-CSRFToken` header in subsequent requests
This is documented in [this discussion](https://github.com/apache/superset/discussions/35855) where others have experienced the same behavior.
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=reply-with-mention&utm_term=apache%2Fsuperset).*
---
Docs are dead. Just use [Dosu](https://dosu.dev?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-tagline&utm_term=apache%2Fsuperset).
[](https://app.dosu.dev/response-feedback?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-feedback&utm_term=apache%2Fsuperset&message_id=f995b4ac-d16b-41fc-a306-a5f9923260a5) [](https://github.dosu.com/apache/superset?utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-ask-repo&utm_term=apache%2Fsuperset) [](https://app.dosu.dev/signup?referrer=openSource&source=github-footer&utm_source=github&utm_medium=bot-comment&utm_campaign=github-comment-footer-20260415&utm_content=static-docs-share-team&utm_term=apache%2Fsuperset)
GitHub link: https://github.com/apache/superset/discussions/38814#discussioncomment-16286730
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org