def test_override_configs(self):
self.app.config['JWT_TOKEN_LOCATION'] = 'cookies'
self.app.config['JWT_HEADER_NAME'] = 'Auth'
self.app.config['JWT_HEADER_TYPE'] = 'JWT'
self.app.config['JWT_COOKIE_SECURE'] = True
self.app.config['JWT_ACCESS_COOKIE_NAME'] = 'banana1'
self.app.config['JWT_REFRESH_COOKIE_NAME'] = 'banana2'
self.app.config['JWT_ACCESS_COOKIE_PATH'] = '/banana/'
self.app.config['JWT_REFRESH_COOKIE_PATH'] = '/banana2/'
self.app.config['JWT_COOKIE_CSRF_PROTECT'] = False
self.app.config['JWT_ACCESS_CSRF_COOKIE_NAME'] = 'banana1a'
self.app.config['JWT_REFRESH_CSRF_COOKIE_NAME'] = 'banana2a'
self.app.config['JWT_CSRF_HEADER_NAME'] = 'bananaaaa'
self.app.config['JWT_ACCESS_TOKEN_EXPIRES'] = timedelta(minutes=5)
self.app.config['JWT_REFRESH_TOKEN_EXPIRES'] = timedelta(days=7)
self.app.config['JWT_ALGORITHM'] = 'HS512'
self.app.config['JWT_BLACKLIST_ENABLED'] = True
self.app.config['JWT_BLACKLIST_STORE'] = simplekv.memory.DictStore()
self.app.config['JWT_BLACKLIST_TOKEN_CHECKS'] = 'all'
with self.app.test_request_context():
self.assertEqual(get_token_location(), 'cookies')
self.assertEqual(get_jwt_header_name(), 'Auth')
self.assertEqual(get_jwt_header_type(), 'JWT')
self.assertEqual(get_cookie_secure(), True)
self.assertEqual(get_access_cookie_name(), 'banana1')
self.assertEqual(get_refresh_cookie_name(), 'banana2')
self.assertEqual(get_access_cookie_path(), '/banana/')
self.assertEqual(get_refresh_cookie_path(), '/banana2/')
self.assertEqual(get_cookie_csrf_protect(), False)
self.assertEqual(get_access_csrf_cookie_name(), 'banana1a')
self.assertEqual(get_refresh_csrf_cookie_name(), 'banana2a')
self.assertEqual(get_csrf_header_name(), 'bananaaaa')
self.assertEqual(get_access_expires(), timedelta(minutes=5))
self.assertEqual(get_refresh_expires(), timedelta(days=7))
self.assertEqual(get_algorithm(), 'HS512')
self.assertEqual(get_blacklist_enabled(), True)
self.assertIsInstance(get_blacklist_store(),
simplekv.memory.DictStore)
self.assertEqual(get_blacklist_checks(), 'all')
self.app.config['JWT_TOKEN_LOCATION'] = 'banana'
self.app.config['JWT_HEADER_NAME'] = ''
self.app.config['JWT_ACCESS_TOKEN_EXPIRES'] = 'banana'
self.app.config['JWT_REFRESH_TOKEN_EXPIRES'] = 'banana'
self.app.testing = True # Propagate exceptions
with self.app.test_request_context():
with self.assertRaises(RuntimeError):
get_jwt_header_name()
with self.assertRaises(RuntimeError):
get_access_expires()
with self.assertRaises(RuntimeError):
get_refresh_expires()
with self.assertRaises(RuntimeError):
get_token_location()
def test_default_configs(self):
with self.app.test_request_context():
self.assertEqual(get_access_expires(), timedelta(minutes=15))
self.assertEqual(get_refresh_expires(), timedelta(days=30))
self.assertEqual(get_algorithm(), 'HS256')
self.assertEqual(get_blacklist_enabled(), False)
self.assertEqual(get_blacklist_store(), None)
self.assertEqual(get_blacklist_checks(), 'refresh')
self.assertEqual(get_auth_header(), 'Bearer')
def wrapper(*args, **kwargs):
blacklist_enabled = get_blacklist_enabled()
if not blacklist_enabled:
err = 'JWT_BLACKLIST_ENABLED must be True to access this functionality'
raise RuntimeError(err)
store = get_blacklist_store()
if store is None:
err = 'JWT_BLACKLIST_STORE must be set to access this functionality'
raise RuntimeError(err)
check_type = get_blacklist_checks()
if check_type not in ('all', 'refresh'):
raise RuntimeError('Invalid option for JWT_BLACKLIST_TOKEN_CHECKS')
return fn(*args, **kwargs)
def _encode_access_token(identity, secret, algorithm, token_expire_delta,
fresh, user_claims):
"""
Creates a new access token.
:param identity: Some identifier of who this client is (most common would be a client id)
:param secret: Secret key to encode the JWT with
:param fresh: If this should be a 'fresh' token or not
:param algorithm: Which algorithm to use for the toek
:return: Encoded JWT
"""
# Verify that all of our custom data we are encoding is what we expect
if not isinstance(user_claims, dict):
raise JWTEncodeError('user_claims must be a dict')
if not isinstance(fresh, bool):
raise JWTEncodeError('fresh must be a bool')
try:
json.dumps(user_claims)
except Exception as e:
raise JWTEncodeError('Error json serializing user_claims: {}'.format(
str(e)))
# Create the jwt
now = datetime.datetime.utcnow()
uid = str(uuid.uuid4())
token_data = {
'exp': now + token_expire_delta,
'iat': now,
'nbf': now,
'jti': uid,
'identity': identity,
'fresh': fresh,
'type': 'access',
'user_claims': user_claims,
}
if get_token_location() == 'cookies' and get_cookie_csrf_protect():
token_data['csrf'] = _create_csrf_token()
encoded_token = jwt.encode(token_data, secret, algorithm).decode('utf-8')
# If blacklisting is enabled and configured to store access and refresh tokens,
# add this token to the store
blacklist_enabled = get_blacklist_enabled()
if blacklist_enabled and get_blacklist_checks() == 'all':
store_token(token_data, revoked=False)
return encoded_token
def test_override_configs(self):
self.app.config['JWT_ACCESS_TOKEN_EXPIRES'] = timedelta(minutes=5)
self.app.config['JWT_REFRESH_TOKEN_EXPIRES'] = timedelta(days=7)
self.app.config['JWT_ALGORITHM'] = 'HS512'
self.app.config['JWT_BLACKLIST_ENABLED'] = True
self.app.config['JWT_BLACKLIST_STORE'] = simplekv.memory.DictStore()
self.app.config['JWT_BLACKLIST_TOKEN_CHECKS'] = 'all'
self.app.config['JWT_AUTH_HEADER'] = 'JWT'
with self.app.test_request_context():
self.assertEqual(get_access_expires(), timedelta(minutes=5))
self.assertEqual(get_refresh_expires(), timedelta(days=7))
self.assertEqual(get_algorithm(), 'HS512')
self.assertEqual(get_blacklist_enabled(), True)
self.assertIsInstance(get_blacklist_store(),
simplekv.memory.DictStore)
self.assertEqual(get_blacklist_checks(), 'all')
self.assertEqual(get_auth_header(), 'JWT')
def check_if_token_revoked(token):
"""
Checks if the given token has been revoked.
"""
store = get_blacklist_store()
check_type = get_blacklist_checks()
token_type = token['type']
jti = token['jti']
# Only check access tokens if BLACKLIST_TOKEN_CHECKS is set to 'all`
if token_type == 'access' and check_type == 'all':
stored_data = json.loads(store.get(jti).decode('utf-8'))
if stored_data['revoked']:
raise RevokedTokenError('Token has been revoked')
# Always check refresh tokens
if token_type == 'refresh':
stored_data = json.loads(store.get(jti).decode('utf-8'))
if stored_data['revoked']:
raise RevokedTokenError('Token has been revoked')
def test_default_configs(self):
with self.app.test_request_context():
self.assertEqual(get_token_location(), 'headers')
self.assertEqual(get_jwt_header_name(), 'Authorization')
self.assertEqual(get_jwt_header_type(), 'Bearer')
self.assertEqual(get_cookie_secure(), False)
self.assertEqual(get_access_cookie_name(), 'access_token_cookie')
self.assertEqual(get_refresh_cookie_name(), 'refresh_token_cookie')
self.assertEqual(get_access_cookie_path(), None)
self.assertEqual(get_refresh_cookie_path(), None)
self.assertEqual(get_cookie_csrf_protect(), True)
self.assertEqual(get_access_csrf_cookie_name(),
'csrf_access_token')
self.assertEqual(get_refresh_csrf_cookie_name(),
'csrf_refresh_token')
self.assertEqual(get_csrf_header_name(), 'X-CSRF-TOKEN')
self.assertEqual(get_access_expires(), timedelta(minutes=15))
self.assertEqual(get_refresh_expires(), timedelta(days=30))
self.assertEqual(get_algorithm(), 'HS256')
self.assertEqual(get_blacklist_enabled(), False)
self.assertEqual(get_blacklist_store(), None)
self.assertEqual(get_blacklist_checks(), 'refresh')
