📝 Add a built-in JWT access token verification flow. (#1129)
FEATURE
Thesis
Add a built-in JWT access token verification flow.
For example, django-modern-rest could provide a reusable controller:
from dmr.security.jwt.views import VerifyTokenSyncController
class TokenVerifyController(VerifyTokenSyncController):
pass
Expected behavior:
• accept an encoded token from the request body
• decode and validate the JWT
• reject malformed tokens
• reject expired tokens
• reject refresh tokens when an access token is expected
• verify that the token subject belongs to an existing active user
• return a successful empty response when the token is valid
The exact public API can be different. It could be implemented as a controller,
auth class, or reusable JWT verification component.
Reasoning
django-modern-rest already provides JWT obtain and refresh controllers, but
applications commonly also need a token verification endpoint.
Without built-in support, each project has to implement the same logic manually:
from django.conf import settings
from dmr.exceptions import NotAuthenticatedError
from dmr.security.jwt.token import JWToken
token = JWToken.decode(
encoded_token=encoded_token,
secret=str(settings.SECRET_KEY),
algorithm="HS256",
)
if token.extras.get("type") != "access":
raise NotAuthenticatedError
user = User.objects.get(pk=token.sub)
if not user.is_active:
raise NotAuthenticatedError
This logic is not application-specific. It is part of the common JWT API
surface.
Providing it in django-modern-rest would reduce duplication and make JWT support
more complete. It would also make error handling more consistent with the
existing obtain and refresh controllers.
#feature #good_first_issue #help_wanted #django_modern_rest
sent via relator