Problem Superset 6.0 and dashboard embedding with SDK (java and jsp)

[yugviren]

I am trying to embed dashboard with my web application. All API calling handled by SDK automatically only need to arrange guest token. Till ambed api working as per expectations but dashboard, dataset and graph API response with 403. After an week I am confused that it need bearer token in js code to complete loading of dashboard. If yes which SDK js version support or I should go with older version of superset. Please help me out to came out of this situation..

Thanks

[dosubot[bot]]

Hi @yugviren! I'm Dosu and I’m helping the superset team.

The 403 errors you're seeing on dashboard, dataset, and chart API calls are almost certainly a permissions issue on the guest role, not a missing bearer token. The Embedded SDK handles authentication automatically — you do not need to pass a bearer token in your JS code. The guest token (sent via the X-GuestToken header) covers all sub-requests (dashboards, charts, datasets) [1].

Here's a checklist to resolve the 403s:

1. Enable the feature flag in superset_config.py [2]:

   FEATURE_FLAGS = {
       "EMBEDDED_SUPERSET": True
   }

2. Ensure the guest role has sufficient permissions. The role used is whatever GUEST_ROLE_NAME is set to (default: "Public"). It needs at minimum [3]:

   • can read on Dashboard, Chart, Dataset, Database
   • can list, can get on Dataset and Database
   • can explore and can explore_json on Superset
   • can read on CurrentUserRestApi (commonly missed — causes blank screens)
   • can log on Superset (new requirement in v6.0.0+) [4]
   • can time range on Api (if using time filters)

3. The roles field in the guest token payload is ignored — Superset always uses the GUEST_ROLE_NAME configuration instead [5]. If you want a custom role, set it in config:

   GUEST_ROLE_NAME = "EmbeddedViewer"

4. Only dashboard IDs go in the token's resources field — charts and datasets associated with those dashboards are automatically accessible. Don't list them separately [5].

5. CORS / frame configuration [2]:

   ENABLE_CORS = True
   OVERRIDE_HTTP_HEADERS = {"X-Frame-Options": "ALLOWALL"}
   SESSION_COOKIE_SAMESITE = "None"
   SESSION_COOKIE_SECURE = True

6. SDK version: For Superset 6.0, use @superset-ui/[email protected] [6]. Always match the SDK version to your Superset server version [7].

Since you mentioned you're using Java/JSP on the backend, your flow should be:

• Backend (Java): Call POST /api/v1/security/guest_token/ with admin credentials to create the guest token
• Frontend (JS): Pass that token to embedDashboard({ fetchGuestToken: () => yourToken, ... }) — the SDK takes care of the rest, including automatic token refresh [8]

The most likely culprit for your 403s is the guest role missing required permissions, especially the newer ones added in v6. I'd start by auditing the permissions on your GUEST_ROLE_NAME role against the list above.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}
   

[yugviren]

@ChadRosseau ,
Thanks For considering my Problem!

I had try everything you had mention but still last 3 API facing 403.

[yugviren]

Need to add custom security code within config file to remove 403 error...........

class CustomSecurityManager(SupersetSecurityManager):

def has_access(self, permission_name, view_name):
    user = current_user
    print(f"[AUTH CHECK] user={user} permission={permission_name} view={view_name}")

    # Allow guest token users
    if user and getattr(user, "is_guest_user", False):
        return True

    return super().has_access(permission_name, view_name)

CUSTOM_SECURITY_MANAGER = CustomSecurityManager