Claims not being updated after token refresh

[tomcajot]

I'm currently facing an issue where, after I refresh my token, the claims aren't being updated and the value is outdated. Until I create a new token by signin a user in.
I simply implemented a custom TokenObtainPairSerializer like the docs recommend. Is there a specific setting I should change in order to have the claims be regenerated when the token gets updated? Please tell me if there is any piece of code you'd like to check. Thanks.

[doublo7]

I accidentally dived into the source code and found something that might be relevant to your problem.

The issue I encountered is after I set "rotate_refresh_token = True", every time when my fresh token updated with a new "iat", the corresponding access token still carry the "iat" value from the previous refresh token.

After reviewing the code, I found the issue is from tokens.py, in the class RefreshToken(BlacklistMixin, Token):

@property
    def access_token(self):
        """
        Returns an access token created from this refresh token.  Copies all
        claims present in this refresh token to the new access token except
        those claims listed in the `no_copy_claims` attribute.
        """
        access = self.access_token_class()

        # Use instantiation time of refresh token as relative timestamp for
        # access token "exp" claim.  This ensures that both a refresh and
        # access token expire relative to the same time if they are created as
        # a pair.
        access.set_exp(from_time=self.current_time)

        no_copy = self.no_copy_claims
        for claim, value in self.payload.items():
            if claim in no_copy:
                continue
            access[claim] = value

        return access

When getting the Access token after refreshing, it copy some claims from the current Refresh token.

and in the serializers.py, in the class TokenRefreshSerializer(serializers.Serializer):

def validate(self, attrs):
        refresh = self.token_class(attrs["refresh"])

        data = {"access": str(refresh.access_token)}

        if api_settings.ROTATE_REFRESH_TOKENS:
            if api_settings.BLACKLIST_AFTER_ROTATION:
                try:
                    # Attempt to blacklist the given refresh token
                    refresh.blacklist()
                except AttributeError:
                    # If blacklist app not installed, `blacklist` method will
                    # not be present
                    pass

            refresh.set_jti()
            refresh.set_exp()
            refresh.set_iat()

            data["refresh"] = str(refresh)

        return data

The access token remains some "copied" claims with the "outdated" refresh token, and doesn't renew with the "new" refresh token.

I guess there should be a possibility that the no_copy_claims could be configured.
Hope this helps.

[blueshack112]

Would be great if we can get some info on this by the devs. Faced the same issue recently

[blueshack112]

I solved it by a custom refresh token view serializer that uses a RefreshToken subclass. The access_token function of this subclass finds the uid, gets the user from db, and recreates a new refresh token and returns the access token off to that. Wondered if there was a better way than overriding classes this drastically. I don't like that I'm creating a new refresh token out and only using it's access token. Not an expert on JWT but I would guess that there is some configuration where access and refresh are linked and this code of mine will destroy the authentication in that configuration :D

Something like "FORCE_REEVALUATE_ACCESS_ON_REFRESH" which can be enabled and clearly known to be more expensive since it makes more db calls I guess.

This is my code by the way:

class MyRefreshToken(RefreshToken):
    @property
    def access_token(self) -> typing.Optional[AccessToken]:
        """
        Returns an access token created from this refresh token.  Copies all
        claims present in this refresh token to the new access token except
        those claims listed in the `no_copy_claims` attribute.

        # TODO: Surely there is a better way to do this by avoiding overriding of classes. Couldn't find it for now
        """
        uid = self.payload.get("uid")
        if uid:
            user: User = User.objects.get(pk=uid)
            refresh = MyTokenObtainPairSerializer.get_token(user)
            return refresh.access_token

        return super().access_token


class MyTokenRefreshSerializer(TokenRefreshSerializer):
    token_class = MyRefreshToken

[bmjr]

I encountered a similar issue where the iat (issued at) claim of an access token generated by the refresh view matched the iat of the refresh token instead of reflecting the issue time of the newly generated access token. This behaviour contradicts the specifications outlined in RFC 7519

This did cause me some confusion.