Enable sending access token in response while sending refresh in a cookie

[creationspirit]

Currently when using long running refresh tokens if jwt_cookie decorator is set both tokens will be send in separate cookies. There should be an option to send only refresh token in a cookie while access token is sent in body response.

This way, access token can be stored in memory which is OAuth2 recommendation for token storage: https://auth0.com/docs/tokens/token-storage

[syberen]

This is a very good point. To solve this in one of my projects I created an adapted version of the jwt_cookie decorator. I would however be glad to create a pull request to make sending an access token cookie into a setting, if the maintainers think that's a good idea as well.

from functools import wraps

from graphql_jwt.utils import set_cookie, delete_cookie
from graphql_jwt.settings import jwt_settings


def jwt_refresh_cookie(view_func):
    """
    Adaptation of the jwt_cookie decorator from graphql_jwt. The default decorator
    sets both a jwt and refresh token cookie, the adaptation sets only the latter.
    """

    @wraps(view_func)
    def wrapped_view(request, *args, **kwargs):
        request.jwt_cookie = True
        response = view_func(request, *args, **kwargs)

        if hasattr(request, "jwt_refresh_token"):
            refresh_token = request.jwt_refresh_token
            expires = refresh_token.created + jwt_settings.JWT_REFRESH_EXPIRATION_DELTA

            set_cookie(
                response,
                jwt_settings.JWT_REFRESH_TOKEN_COOKIE_NAME,
                refresh_token.token,
                expires=expires,
            )

        if hasattr(request, "delete_jwt_cookie"):
            delete_cookie(response, jwt_settings.JWT_COOKIE_NAME)

        if hasattr(request, "delete_refresh_token_cookie"):
            delete_cookie(response, jwt_settings.JWT_REFRESH_TOKEN_COOKIE_NAME)

        return response

    return wrapped_view

[Stijn-B]

@syberen I ran into this problem as well and was thinking about to trying to fix it with a decorator as well

There seem to be 2 other issues related to this:

• [Question] Implementation of per-cookie authentication #230
• JWT token and Refresh Token are both returned as HTTP_ONLY cookies #276

I think it would be good to create a pull request for this. Especially since sending the jwt in the payload and the refresh token in an http only cookie currently seems to be safest approach.

I hope this gets some feedback from the maintainers!
Kind regards