Skip to content

Commit

Permalink
Change middleware name
Browse files Browse the repository at this point in the history
  • Loading branch information
poxip committed Aug 4, 2017
1 parent 1e88eb7 commit 10f1647
Show file tree
Hide file tree
Showing 4 changed files with 8 additions and 7 deletions.
2 changes: 1 addition & 1 deletion CHANGELOG.txt
Original file line number Diff line number Diff line change
Expand Up @@ -8,4 +8,4 @@ All notable changes to this project will be documented in this file.
- ObtainJSONWebToken view
- DeviceRefreshJSONWebToken view
- DeviceLogout view
- PermitHeadersMiddleware
- PermittedHeadersMiddleware
9 changes: 5 additions & 4 deletions README.rst
Original file line number Diff line number Diff line change
Expand Up @@ -73,18 +73,19 @@ new permanent token. To customize the expiration time and expiration accuracy, s
``REST_FRAMEWORK`` configuration in **settings.py**


**PermitHeaders middleware**
**PermittedHeadersMiddleware**

As you may know, the content of a permanent token is a very fragile information, which should be sent along with a
request only when it is needed. To avoid situations in which a front-end developer has incorrectly implemented the
permanent token authentication on the front-end side and the permanent token value is sent with all requests
(just like the JWT token), the ``jwt_devices.middleware.PermitHeadersMiddleware`` comes in handy. The middleware looks
(just like the JWT token), the ``jwt_devices.middleware.PermittedHeadersMiddleware`` comes in handy. The middleware looks
for ``Permanent-Token`` in the headers, and checks if the view is not the
``jwt_devices.views.DeviceRefreshJSONWebToken`` in which the ``Permanent-Token`` header is obligatory, otherwise it
returns a **400 Bad Request** error.

To use the ``PermitHeadersMiddleware`` in your application, add ``jwt_devices.middleware.PermitHeadersMiddleware``
to your ``MIDDLEWARES`` or ``MIDDLEWARE_CLASSES`` (in Django <1.10) in Django settings.
To use the ``jwt_devices.middleware.PermittedHeadersMiddleware`` in your application, add
``jwt_devices.middleware.jwt_devices.middleware.PermittedHeadersMiddleware`` to your ``MIDDLEWARES`` or
``MIDDLEWARE_CLASSES`` (in Django <1.10) in Django settings.

**Settings**

Expand Down
2 changes: 1 addition & 1 deletion jwt_devices/middleware.py
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
from jwt_devices.settings import api_settings


class PermitHeadersMiddleware(object):
class PermittedHeadersMiddleware(object):
"""
Middleware used to disallow sending the permanent_token header in other requests than during permanent token
refresh to make sure naive FE developers do not send the fragile permanent token with each request.
Expand Down
2 changes: 1 addition & 1 deletion tests/conftest.py
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ def pytest_configure():
"django.middleware.csrf.CsrfViewMiddleware",
"django.contrib.auth.middleware.AuthenticationMiddleware",
"django.contrib.messages.middleware.MessageMiddleware",
"jwt_devices.middleware.PermitHeadersMiddleware",
"jwt_devices.middleware.PermittedHeadersMiddleware",
),
INSTALLED_APPS=(
"django.contrib.auth",
Expand Down

0 comments on commit 10f1647

Please sign in to comment.