Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Can't send token to token/verify if http-only #191

Open
Luctia opened this issue Dec 16, 2020 · 3 comments
Open

Can't send token to token/verify if http-only #191

Luctia opened this issue Dec 16, 2020 · 3 comments

Comments

@Luctia
Copy link

Luctia commented Dec 16, 2020

In order to verify your token, you should send it to root/token/verify. However, if you are using JWT and are setting the tokens as HTTP-only cookies on the server, the client doesn't have access to this cookie and can thus not verify it.
The same is true for refreshing your token using root/token/refresh.

I think a feature should be added that takes the token from the HTTP-only cookies if no token is provided in the body of the request.

@Luctia
Copy link
Author

Luctia commented Dec 23, 2020

I briefly looked into this but I'm not very much at home in these packages. I'm not sure if the fix for this issue would require changes to rest_framework_simplejwt as well, since this package gets its response directly from that package in jwt_auth.py in line 14.
Would it be possible to add the value of the cookie to the request parameter before calling super().post()? This seems a bit hacky, though.

@SpicyPaper
Copy link

SpicyPaper commented Jan 20, 2021

Duplicate of #96

I believe that the solution proposed in the issue #96 is solving this.
I tested the solution, and it's working pretty well ;)

Of course the best would be to resolve the issue, but since it's also linked to another package (djangorestframework-simplejwt) it's not that easy.

@Luctia
Copy link
Author

Luctia commented Feb 23, 2021

@SpicyPaper thanks for the link, I missed that issue. It seems (so far) to be working for me too, it seems like it wouldn't be a bad idea to implement this into this package and utilize it when using JWT, since it just doesn't work currently. @iMerica, could that code be used in the package?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants