从刷新令牌创建非刷新访问令牌时，flask-jwt-extended current_user标识=无

Question

在我的flask应用程序(Python2.7)中，每当@jwt.expired_token_loader装饰器过期时，我都会尝试通过刷新令牌来触发访问令牌进行刷新。访问令牌和刷新令牌都存储在cookie中(JWT_TOKEN_LOCATION =‘cookie’)。我正在利用文档(https://flask-jwt-extended.readthedocs.io/en/latest/tokens_in_cookies.html)中提供的相同代码来执行此操作，并且我能够成功地生成新的访问令牌。但是，在生成新的访问令牌时，访问令牌的身份声明等于无(get_raw_jwt())。无论我对刷新令牌或访问令牌做了什么，每当我打印jwt_claims或尝试使用current_user = get_jwt_identity()获取当前用户时，它都会将标识返回为None。对我来说，知道哪个用户正在向神经网络提交查询是很重要的，这样我就可以正确地跟踪哪些查询是由哪个用户提交的(一对多关系)。

我尝试过对refresh_token进行故障排除(解码)，但我遇到了一个单独的问题:当我尝试使用decode_token()解码refresh_token时，我得到了一个以InvalidSignatureError结尾的长回溯:签名验证失败。我获取refresh_token并通过https://jwt.io运行它，它会解码令牌。我可以在解码的令牌中看到“身份”声明为我提供了用户的身份，但它告诉我令牌没有经过验证。但是，一旦我选中屏幕上的secret base64 encoded框，签名就会被验证，并且jwt的签名部分也会随之更改。我尝试解码这个修改后的jwt，https://jwt.io为我提供了decode_token函数，但它仍然给我提供相同的错误: InvalidSignatureError:签名验证失败。

我花了几个小时阅读谷歌在flask-jet-extended和PyJWT上提供给我的所有东西，但我不知道如何修复它。我尝试将我的JWT_SECRET_KEY配置修改为不同的字符串，甚至用base64对其进行编码，但这些都不能解决问题。我已经打开和关闭了JWT_COOKIE_CSRF_PROTECT配置。我打开和关闭了JWT_ACCESS_COOKIE_PATH，JWT_REFRESH_COOKIE_PATH.I尝试对refresh_token_cookie和CSRF_refresh_token cookie进行解码。我尝试使用refresh_token_cookie和CSRF_refresh_token cookie运行decode_token()，同时提供csrf_value=request.cookies.get('csrftoken')参数。我尝试过直接从jwt使用decode()函数(从jwt import decode)。

我只是不知道还能做什么，也找不到任何额外的在线资源。任何帮助都非常感谢！

我的下一步是将我的身份验证系统迁移到flask-jet-simple或PyJWT。我真的很想使用JWT来验证我的用户。我不知道如何将JWT与flask-login结合起来，或者这是否可能。我在网上找不到任何有人使用flask-login with JWT的资源。我确实找到了一个相当新的代码库，名为flask-jwt-login，如果我不能解决这个问题，我可能会尝试使用它。最终，我想继续使用flask-jwt-extended。我还需要关注这个web应用程序的其他部分，我想让他的部分做好准备。

不管怎样，这是我的代码，工作流在/login页面上启动。这会将您重定向到/NN页面。一旦访问令牌过期，如果您尝试重新加载/NN页面，它会将自己重新路由到/ token /refresh页面。一旦刷新了令牌，它将返回到/NN页面。

如果我需要上传任何额外的文件，请告诉我。

附言:这是我关于堆栈溢出的第一篇文章，所以请原谅我的格式化问题。

application.py

from flask import url_for,render_template, redirect,request, jsonify,flash,\
                    make_response, session
from flask_jwt_extended import (create_access_token, create_refresh_token,
                            jwt_required, get_jwt_identity, get_jwt_claims,get_current_user,
                            set_access_cookies,set_refresh_cookies,
                            unset_jwt_cookies, get_raw_jwt, jwt_refresh_token_required,decode_token)


from jwt import decode
from forms import RegisterForm, LoginForm, NNForm
from models import Users

from website import app,db,jwt



#ToDo When the token expires I get an HTTP status code of 401 I can use expired_token_loader refresh token.

@app.route('/token/refresh', methods=['GET','POST'])
@jwt_refresh_token_required
@jwt.expired_token_loader
def refresh():
    #Create the new access token
    ref_token = request.cookies.get('refresh_token_cookie')
    csrftoken = request.cookies.get('csrftoken')
    decode_ref_token = decode_token(ref_token)
    current_user = get_jwt_identity()
    print('ref_token:', ref_token)
    print('current_user:', current_user, get_raw_jwt())
    access_token = create_access_token(identity=current_user)

    #Set the JWT access cookie in the response
    print('from refresh():', request.url)
    response = make_response(redirect(request.url))
    set_access_cookies(response,access_token)
    #set_refresh_cookies()
    return response




@app.route('/token/remove', methods=['POST'])
def logout():
    #ToDo Still need to build the logout page.
    response = make_response(redirect(url_for('logout_page')))
    unset_jwt_cookies(response)
    return response




@app.route('/register/', methods=['GET','POST'])
def register_page():
    form = RegisterForm(request.form)
    print( request.method, form.validate_on_submit())
    if request.method == "POST" and form.validate_on_submit():
        user = Users(form.first_name.data, form.last_name.data, \
                     form.email.data, form.password.data, form.organization.data)
        user.save_to_db()
        flash("Thanks for Registering. Please login")

        return redirect(url_for("NN_page"))

    return render_template('register.html',form=form)




@app.route('/login/', methods=['GET','POST'])
def login_page():
    form = LoginForm(request.form)
    print(request.method, request.form)
    if request.method == "POST":
        #This checks if the user is in the db and returns the user obj.
        user = form.validate_on_submit()
        if user:
            access_token = create_access_token(identity=user.email, fresh=True)
            refresh_token = create_refresh_token(identity=user.email)

            response = make_response(redirect(url_for('NN_page')))
            set_access_cookies(response, access_token)
            set_refresh_cookies(response, refresh_token)
            #response.headers['Authorization'] = 'Bearer {}'.format(access_token)
            print(response)
            return response
            #return jsonify({'access_token':access_token})
            #return redirect((url_for("NN_page")))

    return render_template('login_page.html', form=form)






@jwt.invalid_token_loader #This allows me to stop people who have not logged in yet.
def missing_JWT_token(msg):
    print('from missing_JWT_token:', msg)
    return redirect(url_for('login_page'))
    # return "The site being accessed requires a valid JWT to view." \
    #        "Error: {}".format(msg)




@app.route('/NN/', methods=['GET','POST'])
@jwt_required
def NN_page():
    jwt_claims = get_raw_jwt()
    print(jwt_claims)
    print('cookie keys:', request.cookies.get('refresh_token_cookie'))
    user = get_jwt_identity()
    print('User:',user)
    form = NNForm(request.form, headers=request.headers)
    print(request.form, form.validate_on_submit())
    if request.method == "POST" and form.validate_on_submit():

        return redirect((url_for("success_NN_submission")))

    return render_template('NN_page.html', form=form)

config.py

import os
from datetime import timedelta
from base64 import b64encode

secret_key = os.urandom(24)
jwt_secret_key = b64encode('I_love_my_smokes!')

class BaseConfig(object):

    SECRET_KEY = secret_key

    SQLALCHEMY_DATABASE_URI = 'sqlite:///Protein_NN.db'
    SQLALCHEMY_TRACK_MODIFICATION = False

    #JWT_SECRET_KEY = jwt_secret_key
    JWT_ACCESS_TOKEN_EXPIRES = timedelta(minutes=10)
    JWT_REFRESH_TOKEN_EXPIRES = timedelta(minutes=1)
    JWT_TOKEN_LOCATION = 'cookies'
    #JWT_ACCESS_COOKIE_PATH = '/NN/'
    #JWT_REFRESH_COOKIE_PATH ='/token/refresh'
    JWT_COOKIE_CSRF_PROTECT = False

    SESSION_COOKIE_SECURE = True




class DevelopmentConfig(BaseConfig):

    DEBUG = True

    JWT_ACCESS_TOKEN_EXPIRES = timedelta(seconds=5)

    SESSION_COOKIE_SECURE = False

    #PROPOGATE_EXCEPTION = True

    #EMAIL SETTINGS
    MAIL_SERVER = 'smtp.gmail.com'
    MAIL_PORT = 465
    #MAIL_PORT = 587  # This is for TLS
    MAIL_USE_TLS = False
    MAIL_USE_SSL = True
    #MAIL_USERNAME = os.environ['EMAIL_USER']
    #MAIL_PASSWORD = os.environ['EMAIL_PASSWORD']

    #BOOTSTRAP_SERVE_LOCAL = True

这是访问令牌被刷新令牌刷新后get_raw_jwt()返回的结果。

    {'user_claims': {}, u'jti': u'9fb01b6c-619b-4fe6-91d3-73f8609f2f61',
 u'exp': 1547022397, u'iat': 1547022392, u'fresh': False, 
u'type': u'access', u'nbf': 1547022392, u'identity': None}

如您所见，身份声明等于None。

下面是我看到的回溯：

Traceback (most recent call last):
  File "/Users/Danny/.virtualenvs/Raghav_NN_WebApp/lib/python2.7/site-packages/flask/app.py", line 2309, in __call__
    return self.wsgi_app(environ, start_response)
  File "/Users/Danny/.virtualenvs/Raghav_NN_WebApp/lib/python2.7/site-packages/flask/app.py", line 2295, in wsgi_app
    response = self.handle_exception(e)
  File "/Users/Danny/.virtualenvs/Raghav_NN_WebApp/lib/python2.7/site-packages/flask/app.py", line 1741, in handle_exception
    reraise(exc_type, exc_value, tb)
  File "/Users/Danny/.virtualenvs/Raghav_NN_WebApp/lib/python2.7/site-packages/flask/app.py", line 2292, in wsgi_app
    response = self.full_dispatch_request()
  File "/Users/Danny/.virtualenvs/Raghav_NN_WebApp/lib/python2.7/site-packages/flask/app.py", line 1815, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "/Users/Danny/.virtualenvs/Raghav_NN_WebApp/lib/python2.7/site-packages/flask/app.py", line 1719, in handle_user_exception
    return handler(e)
  File "/Users/Danny/.virtualenvs/Raghav_NN_WebApp/lib/python2.7/site-packages/flask_jwt_extended/jwt_manager.py", line 93, in handle_expired_error
    return self._expired_token_callback()
  File "/Users/Danny/Documents/Codes/Ellington/NN App/website/application.py", line 43, in refresh
    print('current_user:', current_user, decode('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiIzNzVlNWExMy1mNjRiLTQxNmItOTY0ZC0wMDg5ODI4NGY2NGQiLCJleHAiOjE1NDcwMTk5ODUsImlhdCI6MTU0NzAxOTkyNSwidHlwZSI6InJlZnJlc2giLCJuYmYiOjE1NDcwMTk5MjUsImlkZW50aXR5IjoiZGFubnlAbWUuY29tIn0.LVEj6As2Uh_xgTbjm94b0M6mJeD0YLkf9KpgNKTZJOw'))
  File "/Users/Danny/.virtualenvs/Raghav_NN_WebApp/lib/python2.7/site-packages/jwt/api_jwt.py", line 92, in decode
    jwt, key=key, algorithms=algorithms, options=options, **kwargs
  File "/Users/Danny/.virtualenvs/Raghav_NN_WebApp/lib/python2.7/site-packages/jwt/api_jws.py", line 156, in decode
    key, algorithms)
  File "/Users/Danny/.virtualenvs/Raghav_NN_WebApp/lib/python2.7/site-packages/jwt/api_jws.py", line 223, in _verify_signature
    raise InvalidSignatureError('Signature verification failed')
InvalidSignatureError: Signature verification failed

Answer 1

在刷新函数上使用这两个单独的装饰器将不会以您希望的方式工作。过期的装载器装饰器不会设置当前用户，因为当调用回调函数时，jwt是无效的。

相反，尝试将刷新代码分解为两个装饰器单独使用的辅助函数：

def refresh_token(username):
    # return flask response from here

@jwt.expired_token_loader
def handle_expired_token():
    # get username here from raw jwt
    username = 'todo'
    return refresh_token(username)

@app.route(‘/refresh)
@jwt_refresh_token_required
def refresh_endpoint():
    username = get_current_identity()
    return refresh_token(username)

您还可以使用自定义装饰器而不是jwt_required装饰器来实现类似的功能。这里讨论了一些例子：https://gitter.im/flask-jwt-extended/Lobby?at=5c1a9b37c35a3002474ddf3d