how to invalid a user's token in serverside about django-graphql-jwt

[mongkok]

Hi @virusdefender,

There is no easy way to invalidate the token when the user changes his password.

You could add a change password time field to the user model and check if the field is grater than the token issued time.

class JSONWebTokenBackend(object):

    def authenticate(self, request=None, **credentials):
        if request is None:
            return None

        token = get_authorization_header(request)

        if token is not None:
            payload = get_payload(token)
            user = get_user_by_payload(payload)

            if user.password_modified > payload['orig_iat']:
            	raise GraphQLJWTError(_('Invalid token'))

            return user

        return None

    def get_user(self, user_id):
        return get_user_by_natural_key(user_id)

[virusdefender]

thanks, my solution is to add user's password hash as a token field

class UserPwdSigHelper:
    def __init__(self, user):
        self.user = user

    def sha256(self, s):
        return hashlib.sha256(s.encode("utf-8")).hexdigest()

    def make_sig(self):
        return self.sha256(
            self.sha256(self.user.username) + "$" + self.user.password
        )

    def verify(self, sig):
        return constant_time_compare(sig, self.make_sig())

def get_user_by_payload(payload):
    username = payload.get(get_user_model().USERNAME_FIELD)

    if username:
        user = get_user_by_natural_key(username)
        if user and user.is_active and UserPwdSigHelper(user).verify(
            payload.get('pwd_sig', '')
        ):
            return user

[mongkok]

Sorry I took so long to answer,
I think adding the datefield field could be a better solution,
jpadilla/django-rest-framework-jwt#105