Skip to content

Apache Superset JWT Secret

Service Name: Apache Superset

Service Description: Apache Superset is an open-source data exploration and visualization platform that allows users to create interactive dashboards and perform data analysis through a web interface.

Service Address: https://superset.apache.org/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the application level through web server configurations or through a proxy server in front of Superset.

Secret Access Scope: The JWT secret is used to sign and verify JSON Web Tokens (JWTs) for authentication and authorization within Apache Superset. It grants access to the Superset API and enables session management.

Secret Revokement URL: Does not exist (changing the secret in the configuration file invalidates all existing tokens)

Secret Example: supersecret_jwt_key_used_to_sign_web_tokens_keep_this_safe

Suspicious Activity Investigation Instructions:

  • Review Superset access logs for unusual login patterns or API access.
  • Check for unexpected user sessions or dashboard access.
  • Monitor for unusual query patterns or data access through the platform.
  • Examine authentication logs for failed login attempts or brute force attacks.
  • Review audit logs for unauthorized configuration changes.

Mitigation Instructions:

  • Change the JWT secret in the Superset configuration file (typically superset_config.py).
  • Update the SECRET_KEY and/or JWT_SECRET_KEY configuration variables.
  • Restart the Superset service to apply the new secret.
  • Force all users to re-authenticate by clearing active sessions.
  • Consider implementing token expiration policies with shorter timeframes.
  • Enable multi-factor authentication if available.
  • Review and update user permissions to enforce the Principle of Least Privilege.