Add a built-in JWT access token verification flow.
featuregood first issuehelp wanted
# Feature
<!-- Thanks for coming up with a proposal! -->
## Thesis
Add a built-in JWT access token verification flow.
For example, django-modern-rest could provide a reusable controller:
```python
from dmr.security.jwt.views import VerifyTokenSyncController
class TokenVerifyController(VerifyTokenSyncController):
pass
```
Expected behavior:
- accept an encoded token from the request body
- decode and validate the JWT
- reject malformed tokens
- reject expired tokens
- reject refresh tokens when an access token is expected
- verify that the token subject belongs to an existing active user
- return a successful empty response when the token is valid
The exact public API can be different. It could be implemented as a controller,
auth class, or reusable JWT verification component.
## Reasoning
django-modern-rest already provides JWT obtain and refresh controllers, but
applications commonly also need a token verification endpoint.
Without built-in support, each project has to implement the same logic manually:
```python
from django.conf import settings
from dmr.exceptions import NotAuthenticatedError
from dmr.security.jwt.token import JWToken
token = JWToken.decode(
encoded_token=encoded_token,
secret=str(settings.SECRET_KEY),
algorithm="HS256",
)
if token.extras.get("type") != "access":
raise NotAuthenticatedError
user = User.objects.get(pk=token.sub)
if not user.is_active:
raise NotAuthenticatedError
```
This logic is not application-specific. It is part of the common JWT API
surface.
Providing it in django-modern-rest would reduce duplication and make JWT support
more complete. It would also make error handling more consistent with the
existing obtain and refresh controllers.
关闭于 2026-07-18 2 条评论