Facing 401 issue in embedded dashboard

[keveen-ghori-tatvasoft]

Bug description

I am not able to render dashboard in embedded mode in Superset 6.1.0. Seeing below logs into pods:

2026-07-13 10:51:59,397:WARNING:superset.async_events.async_query_manager:Parse jwt failed
Traceback (most recent call last):
  File "/app/superset/async_events/async_query_manager.py", line 204, in parse_channel_id_from_request
    return jwt.decode(token, self._jwt_secret, algorithms=["HS256"])["channel"]
  File "/app/.venv/lib/python3.10/site-packages/jwt/api_jwt.py", line 222, in decode
    decoded = self.decode_complete(
  File "/app/.venv/lib/python3.10/site-packages/jwt/api_jwt.py", line 167, in decode_complete
    self._validate_claims(
  File "/app/.venv/lib/python3.10/site-packages/jwt/api_jwt.py", line 273, in _validate_claims
    self._validate_sub(payload, subject)
  File "/app/.venv/lib/python3.10/site-packages/jwt/api_jwt.py", line 300, in _validate_sub
    raise InvalidSubjectError("Subject must be a string")
jwt.exceptions.InvalidSubjectError: Subject must be a string
2026-07-13 10:51:59,397:WARNING:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mappe

Screenshots/recordings

No response

Superset version

master / latest-dev

Python version

3.9

Node version

16

Browser

Chrome

Additional context

No response

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot]

Hi @keveen-ghori-tatvasoft! I'm Dosu and I'm helping the Apache Superset team.

This is a confirmed bug when GLOBAL_ASYNC_QUERIES (GAQ) is enabled with embedded dashboards. The root cause is that get_user_id() returns None for guest/embedded users, and the async query manager sets the JWT sub claim to None in the async_access cookie [1]. PyJWT 2.10.1 enforces strict RFC 7519 compliance and requires sub to be a string when present, so decoding this token raises InvalidSubjectError [2].

This was tracked and fixed in PR #37862, which was merged on July 1, 2026 [3]. The fix conditionally omits the sub claim entirely when user_id is None, rather than setting it to None. However, depending on which build of 6.1.0 you're running, this fix may not yet be included — you may need to update to a newer image.

Workarounds if you can't update immediately:

1. Disable GLOBAL_ASYNC_QUERIES in your superset_config.py — embedded dashboards work fine without it [2].
2. Apply the fix manually by modifying async_query_manager.py to conditionally include the sub claim:

   # Replace:
   sub = str(user_id) if user_id else None
   token = jwt.encode(
       {"channel": async_channel_id, "sub": sub},
       self._jwt_secret,
       algorithm="HS256",
   )
   
   # With:
   payload = {"channel": async_channel_id}
   if user_id:
       payload["sub"] = str(user_id)
   token = jwt.encode(payload, self._jwt_secret, algorithm="HS256")

Can you confirm whether you have GLOBAL_ASYNC_QUERIES enabled, and which exact 6.1.0 build/image you're using? That would help determine if you just need a newer build that includes the fix.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[keveen-ghori-tatvasoft]

@dosu i have deployed Superset in AKS cluster using helm chart 0.17.2 and values.yaml file. Also GLOBAL_ASYNC_QUERIES is enabled because for my case it is necessary.

[dosubot]

Thanks for the details, @keveen-ghori-tatvasoft. That confirms the issue — Helm chart 0.17.2 was published on June 23, 2026, but the fix for this bug (PR #37862) was merged on July 1, 2026, so your deployment does not include it [1] [2].

Since you need GLOBAL_ASYNC_QUERIES enabled, here are your options:

1. Build a custom Superset image from the latest master branch, which includes the fix, and reference it in your Helm chart's values.yaml by overriding the image.repository and image.tag values. This is the most straightforward path.

2. Patch the code in your current image — you can add an init container or a startup script that replaces the problematic lines in async_query_manager.py. The change is small — replace the unconditional "sub": sub with a conditional payload:

   payload = {"channel": async_channel_id}
   if user_id:
       payload["sub"] = str(user_id)
   token = jwt.encode(payload, self._jwt_secret, algorithm="HS256")

3. Wait for a newer Helm chart release — though note that the Helm chart has been officially deprecated in favor of the Superset Kubernetes Operator [3], so a new chart version may not be published soon.

Option 1 (building from latest master) is likely your best bet for a quick resolution on AKS.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[keveen-ghori-tatvasoft]

@dosu Will our current issue be resolved if we deploy Superset version 6.1.0 using Helm chart version 0.20.0? If this is the correct approach, what are the step-by-step procedures required to carry out this deployment? Additionally, please explain how updating only the Helm chart version—while keeping the Superset application version the same—will actually fix our problem. Finally, could you describe how Helm charts work in general during the deployment process in this specific context?

[dosubot]

Great questions, @keveen-ghori-tatvasoft. Let me address each one.

Will upgrading to Helm chart 0.20.0 fix the issue?

Helm chart version 0.20.0 does not exist. The latest published chart version is 0.17.2 (which you're already using). Versions beyond that have not been published [1]. Also, the Helm chart has been officially deprecated in favor of the Superset Kubernetes Operator, so newer chart versions may not be released.

Why updating only the Helm chart version won't fix your problem

This is a critical point: the bug is in the Superset Python application code (async_query_manager.py), not in the Helm chart templates or configuration. The Helm chart is just the deployment packaging — it controls how Superset is deployed to Kubernetes (services, ingress, config, etc.), but the actual application logic lives inside the Docker image. Upgrading the Helm chart version alone won't change the application code running in your containers [2].

How the Helm chart and Docker image relate

The Helm chart determines which Docker image to run via these values.yaml settings [3]:

image:
  repository: apachesuperset.docker.scarf.sh/apache/superset
  tag: ~          # When null, defaults to Chart.yaml's appVersion
  pullPolicy: IfNotPresent

When image.tag is not set, Helm uses the appVersion field from Chart.yaml as the default tag [4]. So the chart version and app version are independent but loosely coupled — the chart just points to a specific Docker image by default, and you can override it.

What you actually need to do

Since the fix from PR #37862 was merged on July 1, 2026 — after your Helm chart 0.17.2 was published (June 23, 2026) — you need a Docker image built from code after that merge date. Here's how:

1. Build a custom image from the latest master branch:

   git clone https://github.com/apache/superset.git
   cd superset
   docker build -t your-registry/superset:6.1.0-patched .
   docker push your-registry/superset:6.1.0-patched

2. Override the image in your Helm values.yaml:

   image:
     repository: your-registry/superset
     tag: "6.1.0-patched"

3. Upgrade your Helm release:

   helm upgrade superset superset/superset -f values.yaml -n <your-namespace>

This keeps your existing Helm chart (0.17.2) but swaps in a Docker image that contains the JWT fix. The chart handles the Kubernetes deployment mechanics; the image contains the actual application code with the bug fix.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[Shivam-Shukla0]

@keveen-ghori-tatvasoft I'd like to work on this issue.

[keveen-ghori-tatvasoft]

@dosu i want to disable subject from token, how to do that? I have added JWT_VERIFY_SUB to False, but still sub error coming. And also suggest PyJWT package downgrade which could resolve this issue.

[dosubot]

@keveen-ghori-tatvasoft, setting JWT_VERIFY_SUB = False won't help here because that's not a setting Superset's async query manager reads. The jwt.decode() call in parse_channel_id_from_request passes no custom options — it only provides the token, secret, and algorithm [1]:

return jwt.decode(token, self._jwt_secret, algorithms=["HS256"])["channel"]

There's no way to disable subject validation through Superset configuration alone.

PyJWT downgrade option

The strict sub must-be-a-string enforcement was introduced in PyJWT 2.10.0. Superset 6.1.0 pins PyJWT at 2.10.1 [2]. To work around the issue via downgrade, you'd install PyJWT 2.9.0 (the last version before the breaking change). In your Docker image, you could add:

RUN pip install PyJWT==2.9.0

This falls within Superset's declared constraint of PyJWT>=2.4.0, <3.0 [3], so it should be compatible.

However, I'd recommend the code patch approach over a PyJWT downgrade, since the downgrade may introduce other compatibility risks and you'd need to maintain it across upgrades. The patch is just a few lines in async_query_manager.py around the token generation [4]:

# In register_request_handlers, replace:
sub = str(user_id) if user_id else None
token = jwt.encode(
    {"channel": async_channel_id, "sub": sub},
    self._jwt_secret,
    algorithm="HS256",
)

# With:
payload = {"channel": async_channel_id}
if user_id:
    payload["sub"] = str(user_id)
token = jwt.encode(payload, self._jwt_secret, algorithm="HS256")

Either approach will resolve the 401 error, but the code patch is the same fix that was officially merged in PR #37862 and is the safer long-term solution.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[keveen-ghori-tatvasoft]

@dosu i have deployed superset in AKS, so in which pod i need to do that?

[dosubot]

@keveen-ghori-tatvasoft, you don't patch individual pods directly — since you're on AKS with Helm, all the relevant pods share the same Docker image. The fix needs to go into that image, and then all pods will pick it up on redeployment.

That said, the pods that execute the affected code are:

• supersetNode (web server) — this is the critical one. It both generates the JWT token with the sub claim (register_request_handlers) and validates it (parse_channel_id_from_request) [1].
• supersetWorker (Celery workers) — these also load AsyncQueryManager and should use the same patched image [2].

Since both use the same Superset Docker image, you fix this in one place — your image — and redeploy. Here's the practical approach:

Option A: PyJWT downgrade (quickest)

Add a pip install to the configOverrides in your values.yaml so it runs at container startup:

configOverrides:
  pyjwt_fix: |
    import subprocess
    subprocess.check_call(["pip", "install", "PyJWT==2.9.0"])

Note: This is a workaround. It runs at config import time, which may not always work cleanly. A custom image is more reliable.

Option B: Custom Docker image (recommended)

Create a Dockerfile:

FROM apachesuperset.docker.scarf.sh/apache/superset:6.1.0

# Option 1: Downgrade PyJWT
RUN pip install PyJWT==2.9.0

# OR Option 2: Apply the code patch (preferred)
COPY async_query_manager_patch.py /tmp/
RUN cp /tmp/async_query_manager_patch.py /app/superset/async_events/async_query_manager.py

Then in your Helm values.yaml, point to your custom image:

image:
  repository: <your-acr-registry>.azurecr.io/superset
  tag: "6.1.0-patched"

And upgrade:

helm upgrade superset superset/superset -f values.yaml -n <your-namespace>

This will roll out new pods for supersetNode, supersetWorker, and any other Superset components — all using the patched image. Option B is the recommended path since it's clean and survives pod restarts.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[keveen-ghori-tatvasoft]

@dosu when i try to load data into chart it is showing below error:

This session has encountered an interruption, and some controls may not work as intended. If you are the developer of this app, please check that the guest token is being generated correctly.

Issue is in retrieving data, but empty dashboard is embedding with data error. Why is that? I have added below code properly:

payload = {"channel": async_channel_id}
if user_id:
    payload["sub"] = str(user_id)
token = jwt.encode(payload, ...)

But still same issue:

" 302 223 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/147.0.0.0"

2026-07-15 06:59:47,730:WARNING:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped
 
202.131.123.10 - - [15/Jul/2026:06:58:52 +0000] "POST /api/v1/chart/data?form_data=%7B%22slice_id%22%3A1759%7D&dashboard_id=99 HTTP/1.1" 500 334 "https://superse.com/embedded/6cc71710-54cd-4628-83f1-cd406fdf4d70" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
2026-07-15 06:58:52,608:WARNING:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped
202.131.123.10 - - [15/Jul/2026:06:58:52 +0000] "GET /api/v1/chart/1748?q=(columns:!(owners.first_name,owners.last_name),keys:!(none)) HTTP/1.1" 404 24 "https://superse.com/embedded/6cc71710-54cd-4628-83f1-cd406fdf4d70" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
2026-07-15 06:58:52,630:WARNING:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped
202.131.123.10 - - [15/Jul/2026:06:58:52 +0000] "GET /api/v1/chart/1751?q=(columns:!(owners.first_name,owners.last_name),keys:!(none)) HTTP/1.1" 404 24 "https://superse.com/embedded/6cc71710-54cd-4628-83f1-cd406fdf4d70" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
2026-07-15 06:58:52,646:WARNING:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped
202.131.123.10 - - [15/Jul/2026:06:58:52 +0000] "GET /api/v1/chart/1753?q=(columns:!(owners.first_name,owners.last_name),keys:!(none)) HTTP/1.1" 404 24 "https://superse.com/embedded/6cc71710-54cd-4628-83f1-cd406fdf4d70" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
2026-07-15 06:58:52,749:WARNING:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped
202.131.123.10 - - [15/Jul/2026:06:58:52 +0000] "GET /api/v1/chart/1754?q=(columns:!(owners.first_name,owners.last_name),keys:!(none)) HTTP/1.1" 404 24 "https://superse.com/embedded/6cc71710-54cd-4628-83f1-cd406fdf4d70" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
2026-07-15 06:58:52,785:WARNING:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped
202.131.123.10 - - [15/Jul/2026:06:58:52 +0000] "GET /api/v1/chart/1755?q=(columns:!(owners.first_name,owners.last_name),keys:!(none)) HTTP/1.1" 404 24 "https://superse.com/embedded/6cc71710-54cd-4628-83f1-cd406fdf4d70" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
2026-07-15 06:58:52,803:WARNING:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped
202.131.123.10 - - [15/Jul/2026:06:58:52 +0000] "GET /api/v1/chart/1747?q=(columns:!(owners.first_name,owners.last_name),keys:!(none)) HTTP/1.1" 404 24 "https://superse.com/embedded/6cc71710-54cd-4628-83f1-cd406fdf4d70" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
2026-07-15 06:58:52,843:WARNING:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped
2026-07-15 06:58:52,851:WARNING:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped
202.131.123.10 - - [15/Jul/2026:06:58:52 +0000] "GET /api/v1/chart/1756?q=(columns:!(owners.first_name,owners.last_name),keys:!(none)) HTTP/1.1" 404 24 "https://superse.com/embedded/6cc71710-54cd-4628-83f1-cd406fdf4d70" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
2026-07-15 06:58:52,853:WARNING:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped
202.131.123.10 - - [15/Jul/2026:06:58:52 +0000] "GET /api/v1/chart/1757?q=(columns:!(owners.first_name,owners.last_name),keys:!(none)) HTTP/1.1" 404 24 "https://superse.com/embedded/6cc71710-54cd-4628-83f1-cd406fdf4d70" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
202.131.123.10 - - [15/Jul/2026:06:58:52 +0000] "GET /api/v1/chart/1758?q=(columns:!(owners.first_name,owners.last_name),keys:!(none)) HTTP/1.1" 404 24 "https://superse.com/embedded/6cc71710-54cd-4628-83f1-cd406fdf4d70" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
2026-07-15 06:58:52,954:WARNING:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped
202.131.123.10 - - [15/Jul/2026:06:58:52 +0000] "GET /api/v1/chart/1763?q=(columns:!(owners.first_name,owners.last_name),keys:!(none)) HTTP/1.1" 404 24 "https://superse.com/embedded/6cc71710-54cd-4628-83f1-cd406fdf4d70" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
2026-07-15 06:58:52,990:WARNING:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped
202.131.123.10 - - [15/Jul/2026:06:58:52 +0000] "GET /api/v1/chart/1762?q=(columns:!(owners.first_name,owners.last_name),keys:!(none)) HTTP/1.1" 404 24 "https://superse.com/embedded/6cc71710-54cd-4628-83f1-cd406fdf4d70" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
2026-07-15 06:58:53,006:WARNING:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped
202.131.123.10 - - [15/Jul/2026:06:58:53 +0000] "GET /api/v1/chart/1760?q=(columns:!(owners.first_name,owners.last_name),keys:!(none)) HTTP/1.1" 404 24 "https://superse.com/embedded/6cc71710-54cd-4628-83f1-cd406fdf4d70" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
202.131.123.10 - - [15/Jul/2026:06:58:53 +0000] "GET /static/assets/6ee7d93f9cc5ccaa3009.chunk.js HTTP/1.1" 200 1205 "https://superse.com/embedded/6cc71710-54cd-4628-83f1-cd406fdf4d70" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
2026-07-15 06:58:53,049:WARNING:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped
202.131.123.10 - - [15/Jul/2026:06:58:53 +0000] "GET /api/v1/chart/1759?q=(columns:!(owners.first_name,owners.last_name),keys:!(none)) HTTP/1.1" 404 24 "https://superse.com/embedded/6cc71710-54cd-4628-83f1-cd406fdf4d70" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
2026-07-15 06:58:53,063:WARNING:root:Failed to add user to db session: Class 'werkzeug.local.LocalProxy' is not mapped

[keveen-ghori-tatvasoft]

Any update on this?