search

jazzband / djangorestframework-simplejwt

A JSON Web Token authentication plugin for the Django REST Framework.
https://django-rest-framework-simplejwt.readthedocs.io/
MIT License
4k stars 662 forks source link

Authentication bug for multi tenant django app #816

Open peymanahmadifar opened 3 months ago

peymanahmadifar commented 3 months ago

The Django SECRET_KEY is cached in the TokenBackend

The TokenBackend class sets the Django SECRET_KEY when it is initialized and then it is cached. If the first call of the APIs of the django app is from the side of any tenant, the SECRET_KEY will be cached, and the subsequent calls of the APIs, even if they are from another tenant, will use the previous SECRET_KEY and the error of invalid access token will not be given.

sterliakov commented 1 month ago

Could you elaborate more on your use case? I struggle to understand what django.config.settings.SECRET_KEY has to do with multitenancy: SECRET_KEY is usually configured per application... It's pretty difficult for some system to have a single instance of TokenBackend and several different instances of django.conf.settings. How does your tenant logic affect SECRET_KEY setting? A short code snippet could be extremely helpful to clarify your intent.