🚀 New issue to wemake-services/django-modern-rest by @sobolevn
📝 Refresh JWT tokens authenticate as access JWT tokens (#1320)


Currently it is possible to auth with JWT access token and JWT refresh token when HeaderJWTSyncAuth / HeaderJWTAsyncAuth / CookieJWT*Auth are used.

We need to change how decode_token method works. It must check:

if token.extras.get('type') != self.expected_token_type:
    raise NotAuthenticatedError

And define expected_token_type attribute on base JWT auth with 'access' as the default value.

(please, do not take this issue before the 1st of September)


#bug #good_first_issue #help_wanted #security #opensource_september #django_modern_rest
sent via relator