Getting error when using RLS filtering in Guest token when GLOBAL_ASYNC_QUERIES is enabled

[sreejithac43]

Bug description

I am getting an error:

"This session has encountered an interruption, and some controls may not work as intended. If you are the developer of this app, please check that the guest token is being generated correctly."

when using RLS filter in GuestToken for embedded dashboard when "GLOBAL_ASYNC_QUERIES" = True. The same GuestToken set up works when GLOBAL_ASYNC_QUERIES is not used
the errors I am getting in the dashboard network are "not authorised" for charts and filter apis and the above quoted message on the top
Note:
I have celery worker and cache set up with a Redis server in both cases
token payload :

{
"user": {
"username": "guest",
"first_name": "guest",
"last_name": "guest"
},
"resources": [
{
"type": "dashboard",
"id": "d035c4d2-3e2c-4e3f-b45e-20ebb8b366e8"
}
],
"rls_rules": [
{
"clause": ""STATEID" = 3"
}
],
"iat": 1734112254.027939,
"exp": 1734112554.027939,
"aud": "http://0.0.0.0:8080/",
"type": "guest"
}

I have seen discussion and PR in
#18924
#24171
and some in slack also addressing this bug but it says it was solved from superset 3.1 and I am using latest superset in my docker pull

Screenshots/recordings

No response

Superset version

master / latest-dev

Python version

3.10

Node version

I don't know

Browser

Chrome

Additional context

No response

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot]

Hey @sreejithac43! 👋 I'm here to help you tackle bugs, answer questions, and even become a contributor.

I found a similar unsolved discussion regarding the issue you're experiencing: how can we use simple rls filter in guest token for embedded dashboard when "GLOBAL_ASYNC_QUERIES": True?, which was last updated on December 16, 2024 ^[1].

The error you're encountering seems related to the use of Row Level Security (RLS) filters with Guest Tokens when the GLOBAL_ASYNC_QUERIES setting is enabled. This issue has been discussed in various threads and was reportedly resolved in Superset version 3.1. However, users on the latest version are still experiencing problems, as noted in the GitHub pull request #18924 and issue #24171.

The problem might be related to how cache keys from guest token RLS clauses are evaluated, which could lead to authorization issues. It might be helpful to review the configurations of your guest tokens and RLS clauses, as suggested in the discussions. Additionally, ensure that your setup aligns with the latest documentation and any updates that might have been made to address this issue.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Other}

[rusackas]

This has been inactive for 4 months now. It might just be an edge case nobody is facing, or perhaps it's resolved in 4.1.2/5.0.0. Are you still facing this one?

[kadlecp]

We are experiencing exactly same problems when using embedded Superset with RLS.
With GLOBAL_ASYNC_QUERIES disabled everything works fine, but once we enable this feature flag we are getting Not authorized when calling /api/v1/chart/data?form_data=%7B%22slice_id%22%3A${SliceId}%7D&dashboard_id=${DashboardID}&force=true