Filter shared dashboards by customer inside the warehouse

How to do it

A dashboard filter can be changed in the address or removed by an edit. Use the warehouse's row access policies, or a view per customer, keyed on a customer ID that your server signs into the embed token. It is Keep each customer's data apart applied to analytics. Search follows the same idea in Filter search results by access inside the query. Give each token a lifetime of 10 minutes or less.

Examples

Python example

import time
import jwt

EMBED_LIFETIME_SECONDS = 600

def embed_token(secret: str, dashboard_id: str, customer_id: str) -> str:
    claims = {"dashboard": dashboard_id, "customer_id": customer_id, "exp": int(time.time()) + EMBED_LIFETIME_SECONDS}
    return jwt.encode(claims, secret, algorithm="HS256")

JavaScript example

import jwt from 'jsonwebtoken';

const EMBED_LIFETIME_SECONDS = 600;

export const embedToken = (secret, dashboardId, customerId) =>
  jwt.sign({ dashboard: dashboardId, customer_id: customerId }, secret, { algorithm: 'HS256', expiresIn: EMBED_LIFETIME_SECONDS });

How to check

Open an embedded dashboard as customer A, then change the customer ID to B's in the address and in the data request. No row of B's appears.

Sources

• PostgreSQL Row security policies
• OWASP Authorization Cheat Sheet

Related rules

• DAT-7 Keep each customer's data apart in Data and databases
• DAT-61 Filter search results by access inside the query in Data and databases