How to implement Remember Me function? about django-graphql-jwt

[mongkok]

Hi @TitanFighter :)

I think the easiest way is to send HTTP header and configure a JWT_PAYLOAD_HANDLER in your settings.

from datetime import timedelta

from graphql_jwt.utils import jwt_payload


def custom_jwt_payload(user, context):
    payload = jwt_payload(user)

    if context.META.get('HTTP_REMEMBER_ME', False):
    	payload['exp'] += timedelta(days=7)

    return payload


GRAPHQL_JWT = {
    'JWT_PAYLOAD_HANDLER': custom_jwt_payload,
}

So you do not need to refresh a token for 7 days + JWT_EXPIRATION_DELTA.

[TitanFighter]

Yeah... I thought about something like that.

I want to clarify: Am I right that the token refresh is used for the security purpose? If so, then in the case of So you do not need to refresh a token for 7 days we lose some level of security.

Maybe, could it be a good idea to add into django-graphql-jwt Remember Me function with the next logic (all requests have HTTP_REMEMBER_ME header):

• refresh token as usual, while REMEMBER_ME user online;
• allow django-graphql-jwt to refresh token, when user comes back next day and send a token with expired exp, but ok-ish orig_iat + JWT_REFRESH_EXPIRATION_DELTA (need to add a check of HTTP_REMEMBER_ME presence in a header);
• when orig_iat + JWT_REFRESH_EXPIRATION_DELTA is expired, send Signature has expired.

Does it make any sense?

[mongkok]

Hi!
I think you should not refresh the token if the user selected remember me and would not use an HTTP header to bypass the refresh for security reasons.

For the moment, I have no plans to include it in this package.

[TitanFighter]

Thanks!