vimalloc
commented
1 year ago I am not able to reproduce this, it seems to be working as expected. Can you provide a complete, minimal, and reproducible example showing this behavior?
Here is my test:
from flask import Flask
from flask import jsonify
from flask_jwt_extended import create_access_token
from flask_jwt_extended import get_jwt_identity
from flask_jwt_extended import jwt_required
from flask_jwt_extended import JWTManager
app = Flask(__name__)
app.config["JWT_SECRET_KEY"] = "super-secret" # Change this!
jwt = JWTManager(app)
@app.route("/login", methods=["POST"])
def login():
return jsonify(create_access_token(identity='lily'))
@app.route("/protected", methods=["GET"])
@jwt_required()
def protected():
current_user = get_jwt_identity()
return jsonify(logged_in_as=current_user), 200
if __name__ == "__main__":
app.run()$ pip freeze | grep -i jwt
Flask-JWT-Extended==4.4.4
PyJWT==2.6.0
$ http POST :5000/login
HTTP/1.1 200 OK
Connection: close
Content-Length: 271
Content-Type: application/json
Date: Thu, 22 Dec 2022 22:31:01 GMT
Server: Werkzeug/2.2.2 Python/3.7.5
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTY3MTc0ODI2MSwianRpIjoiZThhYTg2YTUtMTIzMy00ZTc0LWE3MTgtODdjYTVjZmM3MzhjIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6ImxpbHkiLCJuYmYiOjE2NzE3NDgyNjEsImV4cCI6MTY3MTc0OTE2MX0.crCFmkhq1WJOEIv1ZCH91Tyxs1dUv5tQZmdPeOAFS7c"
$ export JWT="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTY3MTc0ODI2MSwianRpIjoiZThhYTg2YTUtMTIzMy00ZTc0LWE3MTgtODdjYTVjZmM3MzhjIiwidHlwZSI6ImFjY2VzcyIsInN1YiI6ImxpbHkiLCJuYmYiOjE2NzE3NDgyNjEsImV4cCI6MTY3MTc0OTE2MX0.crCFmkhq1WJOEIv1ZCH91Tyxs1dUv5tQZmdPeOAFS7c"
$ http :5000/hello Authorization:"Bearer $JWT"
HTTP/1.1 200 OK
Connection: close
Content-Length: 24
Content-Type: application/json
Date: Thu, 22 Dec 2022 22:32:24 GMT
Server: Werkzeug/2.2.2 Python/3.7.5
{
"logged_in_as": "lily"
}
kshitiz305
negarvahid
After upgrading to PyJWT 2.6.0 (to fix https://github.virtualitics.com/advisories/GHSA-ffqj-6fqr-9h24), the following error occurs when using create_access_token.