Expiring URLs for embeds?

awzirm · June 9, 2017, 12:39pm

I’m interested in generating expiring urls.

I noticed this in the reference app:
“Signed embeds can also be set to have an expiration time, which further improves security.”

github.com

metabase/embedding-reference-apps/blob/master/rails/embedded_analytics/app/views/stats/signed_public_dashboard.html.erb#L3


<h1>Signed dashboards without parameters</h1>
<p>
    This is an example of a signed embedded dashboard. We haven't signed any parameters, but we have signed the resource id (in this case dashboard 1). This is means that only application with the signing key are allowed to embed a Metabase resource (vs the public link which can be copy/pasted and shared). Signed embeds can also be set to have an expiration time, which further improves security.
</p>
<p>
    To embed this dasbhoard in a webpage (as below), you'll need to generate a url on the server by signing a dictionary specifying the resource and it's signed parameters as below
</p>


<pre>
payload = {
  :resource => {:dashboard => 1},
  :params => {
  }

Is there an example or documentation covering the expiration time for embed urls?

awzirm · June 9, 2017, 3:48pm

Is this a JSON Web Token thing vs. a Metabase API thing? I think maybe “yes”