CODEWITHSUNDEEP
djangodjango-rest-frameworkdjango-rest-framework-jwt
bavaza
bavaza

Reputation: 11037

Revoking tokens using Django rest-framework-jwt

I'm thinking of allowing a user to revoke previously issued tokens (yes, even though they are set to expire in 15 minutes), but did not find any way to do so using DRF-jwt.

Right now, I'm considering several options:

Is any of the above the way to go?

Upvotes: 4

Views: 3809

Answers (1)

Raz
Raz

Reputation: 7923

We did it this way in our project:

Add jwt_issue_dt to User model.

Add original_iat to payload. So token refresh won't modify this field.

Compare original_iat from payload and user.jwt_issue_dt:

from calendar import timegm
from rest_framework_jwt.authentication import JSONWebTokenAuthentication

class CustomJSONWebTokenAuthentication(JSONWebTokenAuthentication):

    def authenticate_credentials(self, payload):
        user = super(CustomJSONWebTokenAuthentication, self).authenticate_credentials(payload)
        iat_timestamp = timegm(user.jwt_issue_dt.utctimetuple())
        if iat_timestamp != payload['iat']:
            raise exceptions.AuthenticationFailed('Invalid payload')
        return user

To revoke a token you just need to update the field user.jwt_issue_dt.

Upvotes: 4

Related Questions