Python flask_jwt.JWT Examples

def test_jwt_required_decorator_with_invalid_jwt_tokens(client, user, app):
    app.config['JWT_LEEWAY'] = timedelta(seconds=0)
    app.config['JWT_EXPIRATION_DELTA'] = timedelta(milliseconds=200)

    resp, jdata = post_json(
        client, '/auth', {'username': user.username, 'password': user.password})
    token = jdata['access_token']

    # Undecipherable
    r = client.get('/protected', headers={'authorization': 'JWT %sX' % token})
    assert_error_response(r, 401, 'Invalid token', 'Signature verification failed')

    # Expired
    time.sleep(1.5)
    r = client.get('/protected', headers={'authorization': 'JWT ' + token})
    assert_error_response(r, 401, 'Invalid token', 'Signature has expired') 

def test_custom_decode_handler(client, user, jwt):
    # The following function should receive the decode return value
    @jwt.identity_handler
    def load_user(payload):
        assert payload == {'user_id': user.id}

    @jwt.jwt_decode_handler
    def decode_data(token):
        return {'user_id': user.id}

    with client as c:
        resp, jdata = post_json(
            client, '/auth', {'username': user.username, 'password': user.password})

        token = jdata['access_token']

        c.get('/protected', headers={'authorization': 'JWT ' + token}) 

def test_custom_payload_handler(client, jwt, user):
    @jwt.identity_handler
    def load_user(payload):
        if payload['id'] == user.id:
            return user

    @jwt.jwt_payload_handler
    def make_payload(u):
        iat = datetime.utcnow()
        exp = iat + timedelta(seconds=60)
        nbf = iat + timedelta(seconds=0)
        return {'iat': iat, 'exp': exp, 'nbf': nbf, 'id': u.id}

    with client as c:
        resp, jdata = post_json(
            client, '/auth', {'username': user.username, 'password': user.password})

        token = jdata['access_token']

        c.get('/protected', headers={'authorization': 'JWT ' + token})
        assert flask_jwt.current_identity == user 

def jwt_request_handler():
    auth_header_name = app.config['JWT_AUTH_HEADER_NAME']
    auth_header_value = request.headers.get(auth_header_name, None)
    auth_header_prefix = app.config['JWT_AUTH_HEADER_PREFIX']

    if not auth_header_value:
        return

    parts = auth_header_value.split()

    if parts[0].lower() != auth_header_prefix.lower():
        raise JWTError('Invalid JWT header', 'Unsupported authorization type')
    elif len(parts) == 1:
        raise JWTError('Invalid JWT header', 'Token missing')
    elif len(parts) > 2:
        raise JWTError('Invalid JWT header', 'Token contains spaces')

    return parts[1] 

def jwt():
    return flask_jwt.JWT() 

def test_initialize():
    app = Flask(__name__)
    app.config['SECRET_KEY'] = 'super-secret'
    jwt = flask_jwt.JWT(app, lambda: None, lambda: None)
    assert isinstance(jwt, flask_jwt.JWT)
    assert len(app.url_map._rules) == 2 

def test_adds_auth_endpoint():
    app = Flask(__name__)
    app.config['SECRET_KEY'] = 'super-secret'
    app.config['JWT_AUTH_URL_RULE'] = '/auth'
    app.config['JWT_AUTH_ENDPOINT'] = 'jwt_auth'
    flask_jwt.JWT(app, lambda: None, lambda: None)
    rules = [str(r) for r in app.url_map._rules]
    assert '/auth' in rules 

def test_jwt_required_decorator_with_valid_token(app, client, user):
    resp, jdata = post_json(
        client, '/auth', {'username': user.username, 'password': user.password})

    token = jdata['access_token']
    resp = client.get('/protected', headers={'Authorization': 'JWT ' + token})

    assert resp.status_code == 200
    assert resp.data == b'success' 

def test_jwt_required_decorator_with_valid_request_current_identity(app, client, user):
    with client as c:
        resp, jdata = post_json(
            client, '/auth', {'username': user.username, 'password': user.password})
        token = jdata['access_token']

        c.get(
            '/protected',
            headers={'authorization': 'JWT ' + token})
        assert flask_jwt.current_identity 

def test_jwt_required_decorator_with_invalid_authorization_headers(app, client):
    # Missing authorization header
    r = client.get('/protected')

    assert_error_response(
        r, 401, 'Authorization Required', 'Request does not contain an access token')

    assert r.headers['WWW-Authenticate'] == 'JWT realm="Login Required"'

    # Not a JWT auth header prefix
    r = client.get('/protected', headers={'authorization': 'Bogus xxx'})

    assert_error_response(
        r, 401, 'Invalid JWT header', 'Unsupported authorization type')

    # Missing token
    r = client.get('/protected', headers={'authorization': 'JWT'})

    assert_error_response(
        r, 401, 'Invalid JWT header', 'Token missing')

    # Token with spaces
    r = client.get('/protected', headers={'authorization': 'JWT xxx xxx'})

    assert_error_response(
        r, 401, 'Invalid JWT header', 'Token contains spaces') 

def test_jwt_required_decorator_with_missing_user(client, jwt, user):
    resp, jdata = post_json(
        client, '/auth', {'username': user.username, 'password': user.password})
    token = jdata['access_token']

    @jwt.identity_handler
    def load_user(payload):
        return None

    r = client.get('/protected', headers={'authorization': 'JWT %s' % token})
    assert_error_response(r, 401, 'Invalid JWT', 'User does not exist') 

def test_custom_auth_handler():
    def custom_auth_request_handler():
        return jsonify({'hello': 'world'})

    jwt = flask_jwt.JWT()
    pytest.deprecated_call(jwt.auth_request_handler, custom_auth_request_handler)

    app = Flask(__name__)
    jwt.init_app(app)

    with app.test_client() as c:
        resp, jdata = post_json(c, '/auth', {})
        assert jdata == {'hello': 'world'} 

def create_app(environment):
    app = Flask(__name__)
    app.config.from_object(config[environment])

    db.init_app(app)
    migrate.init_app(app, db=db)

    from .auth.models import User

    def authenticate(email, password):
        data = request.json
        user = User.query.filter_by(email=data['email']).first()
        if user is not None and user.verify_password(data['password']):
            return user

    def identity(payload):
        user_id = payload['identity']
        return User.query.filter_by(id=user_id).first()

    jwt = JWT(app, authenticate, identity)


    from .auth import auth as auth_blueprint
    app.register_blueprint(auth_blueprint, url_prefix='/auth')

    from .todo import todo as todo_blueprint
    app.register_blueprint(todo_blueprint)

    return app 

def log_out():
    logout_user()
    return redirect(request.args.get('next') or '/')


# JWT Token authentication  ===================================================