Comments (4)
UPDATE: I think I understand now. If I want to treat updating a registration as sign out and back in, then it's not enough to just configure that route as also a revocation_requests, since I do not want to revoke on a bad request. Did I get it right now?
Correct. You will have to revoke it manually from the controller code. But it is not difficult:
token = request.headers['Authorization']
payload = Warden::JWTAuth::TokenDecoder.new.call(token)
MyRevocationStrategy.revoke_jwt(payload, current_user)
from devise-jwt.
Hi @timscott .
Your reasoning makes sense. However, personally I'm against encoding information which is subject to change into the JWT. With JWT technology, there is nothing the server can do to revoke a single token, so if the information on it becomes obsolete there is no way to be sure that the client won't use it again fraudulently.
I added a thin revocation layer on top of this library. But this revocation layer is useful when the client wants to revoke a token, usually on sign out. If the client doesn't send the JWT token you (as application developer) want to become expired to the server, there is nothing the server can do. So, in your scenario, if you want to be sure that the staled token is not going to be reused, you should configure your registrations#update
path as both a revocation path and a dispatch path.
As I generally consider it a bad practice, I'm not going to include it in the library default behavior. However, if you still want to implement it, it should be possible configuring registrations#update
path as both dispatch_requests
and revocation_requests
(look at the Configuration reference section in the Readme).
from devise-jwt.
However, if you need to differentiate a success response from a response to some error in the form, as I guess it would be usually the case, you would need to do more handwork.
From the controller, you should call the revocation strategy (whether a blacklist model or the user model itself) revoke_jwt
method if there are no errors, along with adding a new token to the response using underlying warden-jwt_auth
library:
Warden::JWTAuth.UserEncoder.new.call(user, scope)
Let me know if you need more guiding with this.
from devise-jwt.
Thanks for the rapid reply! I added this to my config:
jwt.dispatch_requests = [
['PATCH', %r{^/auth$}]
]
Now when I make call to PATCH /auth
(which is the route for registrations#update
) I am getting back an updated token. I get the token in the case of a valid request (204) or a bad request (422). I understand that I should only update the token on the client in the case of success.
So this seems to work fine for me with no other changes on the server. Is there something else I need to do? (I guess I did not quite understand your advice about the controller.)
UPDATE: I think I understand now. If I want to treat updating a registration as sign out and back in, then it's not enough to just configure that route as also a revocation_requests
, since I do not want to revoke on a bad request. Did I get it right now?
from devise-jwt.
Related Issues (20)
- JWT::DecodeError when a small token is used at session#destroy HOT 3
- Auto removal of expired jwt token from AllowList table HOT 1
- Can't get JWT token when using devise and JWT for reset password feature HOT 7
- Devise Resource not Authenticated HOT 4
- Devise Resource not Authenticated and Authorization header missing HOT 2
- How to Avoid Session storage caveat HOT 4
- Session Store Caveat Solution? HOT 5
- [Question] Does the login function add jti value on existing database ? HOT 7
- Not getting the JWT token when signing in via a graphql-ruby mutation HOT 9
- JWT::DecodeError when passing token such as "Bearer test" HOT 7
- No content while trying to validate reset_password_token to recover password HOT 1
- current_user nil after authentication HOT 1
- Authenticate_user controller helper returns 401 regardless of token validity HOT 2
- Desive JWT import in application.rb throwing is error HOT 3
- Consider advising users to add this code to revoke the JWT on password reset HOT 3
- Feature Request: Dynamic Method for Setting JWT Expiration Time HOT 3
- Devise::JWT::TestHelpers not authenticate in rspec test HOT 4
- There is an issue with the handling of the `Authorization` HOT 2
- Error on sign_out with JWT::DecodeError (No verification key available) In Production Environment HOT 3
- version 0.12.0 does not properly add support for issuer and token_header HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from devise-jwt.