vimalloc-mavenlink
commented
3 years ago You're doing something wrong, this extension absolutely handles optional situations correctly. Maybe you forgot to set the JWT_HEADER_TYPE to JWT instead of the default Bearer?
Here is an minimal example showing that non-valid tokens are still kicked out of an optionally protected endpoint:
from flask import Flask
from flask import jsonify
from flask_jwt_extended import create_access_token
from flask_jwt_extended import jwt_required
from flask_jwt_extended import JWTManager
app = Flask(__name__)
app.config["JWT_SECRET_KEY"] = "super-secret"
app.config["JWT_HEADER_TYPE"] = "JWT"
jwt = JWTManager(app)
@app.route("/login", methods=["POST"])
def login():
return jsonify(access_token=create_access_token(identity='example'))
@app.route("/optional", methods=["GET"])
@jwt_required(optional=True)
def protected():
return jsonify(foo='bar')
if __name__ == "__main__":
app.run()No token:
$ http GET :5000/optional
HTTP/1.0 200 OK
Content-Length: 14
Content-Type: application/json
Date: Fri, 30 Apr 2021 16:39:51 GMT
Server: Werkzeug/1.0.1 Python/3.8.8
{
"foo": "bar"
}A valid token:
± http GET :5000/optional Authorization:"JWT $VALID_JWT"
HTTP/1.0 200 OK
Content-Length: 14
Content-Type: application/json
Date: Fri, 30 Apr 2021 16:35:25 GMT
Server: Werkzeug/1.0.1 Python/3.8.8
{
"foo": "bar"
}An expired token:
$ http GET :5000/optional Authorization:"JWT $EXPIRED_JWT"
HTTP/1.0 401 UNAUTHORIZED
Content-Length: 28
Content-Type: application/json
Date: Fri, 30 Apr 2021 16:34:52 GMT
Server: Werkzeug/1.0.1 Python/3.8.8
{
"msg": "Token has expired"
}A token that has been tampered with:
$ http GET :5000/optional Authorization:"JWT $TAMPERED_JWT"
HTTP/1.0 422 UNPROCESSABLE ENTITY
Content-Length: 40
Content-Type: application/json
Date: Fri, 30 Apr 2021 16:33:33 GMT
Server: Werkzeug/1.0.1 Python/3.8.8
{
"msg": "Signature verification failed"
}Not a JWT:
± http GET :5000/optional Authorization:"JWT something_not_even_resembling_a_jwt"
HTTP/1.0 422 UNPROCESSABLE ENTITY
Content-Length: 30
Content-Type: application/json
Date: Fri, 30 Apr 2021 16:36:12 GMT
Server: Werkzeug/1.0.1 Python/3.8.8
{
"msg": "Not enough segments"
}
dmulter
vimalloc
I'm migrating from flask-jwt and make extensive use of decorated required and optional routes. My tests also have extensive coverage for invalid JWT cases. I've confirmed that invalid JWTs are handled correctly for
jwt_required()routes, but not fully forjwt_required(optional=True)routes. Note that I use "JWT" as my prefix instead of "Bearer". I've also seen that flask-jwt-extended test cases do not cover these types of cases for optional routes.Specifically these routes are allowed access for these invalid tokens. It is obviously important that any type of error for a submitted token (in any location) is rejected even when it is optional.