You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
the first GET for todolists as well as the DELETES are OK, but when the next phase goes on (so, getting another csrf and trying to POST a request to /api/todolists/add) then I get Signature verification failed. Few queries later the verification succeeds, and then fails again.
For the verification I am doing the following:
@app.before_requestdefbefore_request():
# the only routes that do not require authentication are the endpoint to login and to retrieve the csrfifrequest.pathin [url_for("api.auth.login"), url_for("api.get_csrf")]:
returnNonetry:
verify_jwt_in_request()
except (NoAuthorizationError, ExpiredSignatureError, InvalidSignatureError) as_exc:
# return static filesreturnNone
and for the refreshing of the token I have the following:
And the answer is: yes, I was doing something wrong. The problem was that I was running flask threaded, and I was setting the variables SECRET_KEY and JWT_SECRET_KEY to a random value generated at boot time. Should I change that to a random string that is constant, then everything works (because all the threads are getting the same value).
I have flask-jwt-extended configured with the following settings, with an app running on a docker container behind nginx:
In my locust test I have the following:
when running this test against the server, I see the following:
the first GET for todolists as well as the DELETES are OK, but when the next phase goes on (so, getting another csrf and trying to POST a request to /api/todolists/add) then I get Signature verification failed. Few queries later the verification succeeds, and then fails again.
For the verification I am doing the following:
and for the refreshing of the token I have the following:
Am I doing something wrong?
The text was updated successfully, but these errors were encountered: