humanitec / django-oauth-toolkit-jwt

django-oauth-toolkit extension that adds JWT support
MIT License
38 stars 26 forks source link

Potential fix for username faking #15

Closed jdmwood closed 5 years ago

jdmwood commented 5 years ago

Potential fix for https://github.com/Humanitec/django-oauth-toolkit-jwt/issues/14

This isn't ideal because it assumes some inner workings of how DOT works and also requires an extra database call to fetch the token.

Also, I actually think it's better to not even allow users to specify the username in the POST and instead just insert it automatically into the JWT payload if found. What do you think? If you agree I'll make that change too.

jdmwood commented 5 years ago

:+1: