Problem with PyJWT 2.10: Subject must be a string

amotl commented 1 day ago

Bug description

When setting up a fresh sandbox environment, PyJWT 2.10 gets installed, released on Nov 17, i.e. three days ago. That breaks a little integration test suite we are running [^1]. This is the exception being raised:

AssertionError: {'msg': 'Subject must be a string'}

When downgrading to use pyjwt<2.10, the test suite succeeds again.

You may want to accompany this by potentially adjusting dependencies or code in Apache Superset?

[^1]: ... which orchestrates CLI invocations of the superset program and HTTP calls to the Superset API, in order to validate it works well together with CrateDB.

Superset version

3.x and 4.x

Additional context

The software test suite maintained here can be used to reproduce the problem.

https://github.com/crate/cratedb-examples/tree/main/application/apache-superset

We added relevant details to this ticket, where we started to investigate this issue.

https://github.com/crate/cratedb-examples/issues/741

Checklist

[X] I have searched Superset docs and Slack and didn't find a solution to my problem.
[X] I have searched the GitHub issue tracker and didn't find a similar bug report.
[X] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

amotl commented 1 day ago

We just found this is most likely the root cause.

https://github.com/jpadilla/pyjwt/issues/1017

The canonical recommendation is to downgrade to PyJWT in the meanwhile.

pip install 'pyjwt<2.10'

amotl commented 1 day ago

That patch submitted by Dependabot also demonstrates the problem.

https://github.com/crate/cratedb-examples/pull/744

amotl commented 16 hours ago

@jkogut: Do you have any idea why only we might be affected, but Superset's test suite seems to still succeed, and nobody else seems to be tripped? Is it related to the value of the SECRET_KEY maybe?

jkogut commented 7 hours ago

@amotl yes indeed that was caused by the incorrect SECRET_KEY. Happened during test migration of superset instance. So indeed please double check SECRET_KEY. 🙏

jkogut commented 4 hours ago

@amotl actually I was wrong, correct SECRET_KEY only allowed me to get access token but cannot proceed further with getting chart list for instance:

def get_chart_list():
    headers = {
        'Authorization': f"Bearer {get_bearer_token()}"
    }
    response = requests.get(f"{base_url}/chart/", headers=headers, verify=False)
    return response.json()

problem observed as reported on Superset 3.1.3, and fixed as recommended with installing PyJWT==2.9.0.

So still looks like new PyJWT 2.10.0 release can cause some problems with Superset API access.

apache / superset