ITADN

Add a built-in JWT access token verification flow.

#1129ClosedZhdanovAM72 创建于 2026-07-06
featuregood first issuehelp wanted
Z
ZhdanovAM72commented
# Feature <!-- Thanks for coming up with a proposal! --> ## Thesis Add a built-in JWT access token verification flow. For example, django-modern-rest could provide a reusable controller: ```python from dmr.security.jwt.views import VerifyTokenSyncController class TokenVerifyController(VerifyTokenSyncController): pass ``` Expected behavior: - accept an encoded token from the request body - decode and validate the JWT - reject malformed tokens - reject expired tokens - reject refresh tokens when an access token is expected - verify that the token subject belongs to an existing active user - return a successful empty response when the token is valid The exact public API can be different. It could be implemented as a controller, auth class, or reusable JWT verification component. ## Reasoning django-modern-rest already provides JWT obtain and refresh controllers, but applications commonly also need a token verification endpoint. Without built-in support, each project has to implement the same logic manually: ```python from django.conf import settings from dmr.exceptions import NotAuthenticatedError from dmr.security.jwt.token import JWToken token = JWToken.decode( encoded_token=encoded_token, secret=str(settings.SECRET_KEY), algorithm="HS256", ) if token.extras.get("type") != "access": raise NotAuthenticatedError user = User.objects.get(pk=token.sub) if not user.is_active: raise NotAuthenticatedError ``` This logic is not application-specific. It is part of the common JWT API surface. Providing it in django-modern-rest would reduce duplication and make JWT support more complete. It would also make error handling more consistent with the existing obtain and refresh controllers.
关闭于 2026-07-18 2 条评论