DRF simplejwt refresh access_token 存储在 HTTPonly cookies 中

Question

我正在做一个使用 React 和 django 的项目，我使用 DRF SimpleJWT 进行身份验证。我在 HTTPOnly cookie 中存储了一个访问和刷新令牌，一切正常，但我没有找到刷新令牌的方法。我无法通过阅读文档来完成。如果有人做过，请分享代码

Answer 1

希望我没有迟到。
一个简单的方法，你可以使用 Dj-Rest-Auth 来处理所有事情。

否则，如果您想使用功能视图，您可以在 views.py 中使用并将其 URL 添加到 urls.py:

@api_view(['POST'])
@permission_classes([AllowAny])
@csrf_protect
def refresh_token_view(request):
    User = get_user_model()
    refresh_token = request.COOKIES.get('refreshtoken')
    if refresh_token is None:
        raise exceptions.AuthenticationFailed(
            'Authentication credentials were not provided.')
    try:
        payload = jwt.decode(
            refresh_token, settings.REFRESH_TOKEN_SECRET, algorithms['HS256'])
    except jwt.ExpiredSignatureError:
        raise exceptions.AuthenticationFailed(
            'expired refresh token, please login again.')

    user = User.objects.filter(id=payload.get('user_id')).first()
    if user is None:
        raise exceptions.AuthenticationFailed('User not found')

    if not user.is_active:
        raise exceptions.AuthenticationFailed('user is inactive')


    access_token = generate_access_token(user)
    return Response({'access_token': access_token})

如果您想使用 class 视图，请将此添加到您的 views.py:

from rest_framework_simplejwt.views import TokenRefreshView, TokenObtainPairView
from rest_framework_simplejwt.serializers import TokenRefreshSerializer
from rest_framework_simplejwt.exceptions import InvalidToken

class CookieTokenRefreshSerializer(TokenRefreshSerializer):
    refresh = None
    def validate(self, attrs):
        attrs['refresh'] = 
self.context['request'].COOKIES.get('refresh_token')
        if attrs['refresh']:
            return super().validate(attrs)
        else:
            raise InvalidToken('No valid token found in cookie\'refresh_token\'')

class CookieTokenObtainPairView(TokenObtainPairView):
    def finalize_response(self, request, response, *args, **kwargs):
        if response.data.get('refresh'):
            cookie_max_age = 3600 * 24 * 14 # 14 days
            response.set_cookie('refresh_token',response.data['refresh'],max_age=cookie_max_age, httponly=True )
        del response.data['refresh']
        return super().finalize_response(request, response, *args, **kwargs)

class CookieTokenRefreshView(TokenRefreshView):
    def finalize_response(self, request, response, *args, **kwargs):
        if response.data.get('refresh'):
            cookie_max_age = 3600 * 24 * 14 # 14 days
            response.set_cookie('refresh_token',response.data['refresh'], max_age=cookie_max_age, httponly=True )
        del response.data['refresh']
        return super().finalize_response(request, response, *args, **kwargs)
    serializer_class = CookieTokenRefreshSerializer

在url.py中添加以下内容以使用上面的视图获取和刷新：

from .views import CookieTokenRefreshView, CookieTokenObtainPairView # Import the above views
urlpatterns = [
path('auth/token/', CookieTokenObtainPairView.as_view(), name='token_obtain_pair'),
path('auth/token/refresh/', CookieTokenRefreshView.as_view(), name='token_refresh'),
]

source

DRF simplejwt refresh access_token 存储在 HTTPonly cookies 中

DRF simplejwt refresh access_token stored in HTTPonly cookies

django

cookie-httponly

django-rest-framework

refresh-token

django-rest-framework-simplejwt