Problem in Apache Superset: PyJWT 2.10 changed semantics, Flask-JWT-Extended 4.7.1 needs a configuration change

[amotl]

Problem

When setting up a fresh sandbox environment, PyJWT 2.10 gets installed, released on Nov 17, i.e. five days ago. That breaks a little integration test suite against Apache Superset we are running.

The initial discovery was reported here:

• https://github.com/crate/cratedb-examples/issues/741

The detailed report and investigation happened here:

• https://github.com/apache/superset/issues/30995

Solution

@jlucier and @vimalloc suggested at https://github.com/apache/superset/issues/30995#issuecomment-2494706861:

Have you configured flask-jwt-extended to not verify the sub claim? 'JWT_VERIFY_SUB=False'.

That probably needs to take place after upgrading to Flask-JWT-Extended 4.7.1, which includes relevant code updates?

[amotl]

We have been able to resolve this by updating to Flask-JWT-Extended 4.7.1 and configuring it using JWT_VERIFY_SUB = False.

• https://github.com/apache/superset/issues/30995#issuecomment-2494789968
• https://github.com/crate/cratedb-examples/pull/749