Added Per-cookie authentication about django-graphql-jwt

[mongkok]

Hi @skitoo :),
I would like to include this feature, unfortunately I do not find an easy way to modify the response object to set the cookie:
https://docs.djangoproject.com/en/2.1/ref/request-response/#django.http.HttpResponse.set_cookie

A decorator for Graphene view could be the best approach:

from django.urls import path

from graphene_django.views import GraphQLView
from graphql_jwt.decoratos import jwt_cookie

urlpatterns = [
    path('graphql/', jwt_cookie(GraphQLView.as_view(), name='JWT-cookie')),
]

Update: Used graphene_django.views instead of graphql_extensions.views.

[skitoo]

I think the best way to inject the cookie into the response is to do it in middleware.
Maybe here ? https://github.com/flavors/django-graphql-jwt/blob/master/graphql_jwt/middleware.py#L75

[mongkok]

Hi @skitoo,

Right now there are two middlewares for authentication:

• Graphene Middleware: can't access the response object.
• Django Middleware: will be deprecated in the future

To configure the cookie we can create a new Django middleware JWTCookieMiddleware or a decorator @jwt_cookie for the view, the two implementations are valid and require a new configuration (settings or urls).

[v-stickykeys]

I have found a solution for this using the Django middleware at least, but I'm guessing it will break with your next update:

def process_response(self, request, response):
        patch_vary_headers(response, ('Authorization',))
        '''
        @dev Store JWT token in session cookie
        @author thevaleriemack
        '''
        if response.content.find(b'tokenAuth') != -1:
            try:
                response_content = bytes_to_dict(response.content)
                token_auth = response_content['data']['tokenAuth']['token']
                request.session['tokenAuth'] = token_auth
            except KeyError:
                pass
        return response

def process_request(self, request):
        if (get_authorization_header(request) is not None and
                (not hasattr(request, 'user') or request.user.is_anonymous)):
            try:
                user = authenticate(request=request)
            except JSONWebTokenError as err:
                return JsonResponse({
                    'errors': [{'message': str(err)}],
                }, status=401)

            if user is not None:
                request.user = request._cached_user = user
        '''
        @dev Access JWT from session cookie if it is not in the header
        @author thevaleriemack
        '''
        if (request.session.get('tokenAuth') and not
            request.META.get('HTTP_AUTHORIZATION')):
            request.META['HTTP_AUTHORIZATION'] = jwt_settings.JWT_AUTH_HEADER_PREFIX + " " + request.session['tokenAuth']
            try:
                user = authenticate(request=request)
            except JSONWebTokenError as err:
                return JsonResponse({
                    'errors': [{'message': str(err)}],
                }, status=401)
            if user is not None:
                request.user = request._cached_user = user
        
        return None

It's a bit hacky i guess? Let me know what you think. Any major flaws here?

[LiamK]

@mongkok I'm also wanting to do this, too. Any chance of getting JWTCookieMiddleware in an upcoming release?

[mongkok]

Sorry for the delay in my response

Django's middleware will be deprecated in the future in favour of Graphene's middleware.

I created a pull request #75 to include cookie authentication using a decorator.
I'll release a new version on PyPI as soon as this PR is merged.

[skitoo]

@mongkok Thank you ! :)

[bastiW]

Thank you a lot :)