Re: DRF simplejwt refresh access_token stored in httponlycookies

2021-05-08 Thread 'OCHIENG LEON' via Django users
Are you using Redux for State management? You could pass in the UserInfo which will include the refresh and access token to the states. On Sat, 8 May 2021, 5:49 am narendra...@gmail.com, < narendrathapa...@gmail.com> wrote: > i'm using django as my backend and react as frontend. i'm using simplej

Re: DRF simplejwt refresh access_token stored in httponlycookies

2021-05-08 Thread Michael Thomas
That depends a bit on the scope of your App and what you need to protect against. In a recent project of mine, for example, all authentication related code (including JWT retrieval/refresh) is within an iframe on a different origin. The client application requests an access token from the "auth" i

Re: DRF simplejwt refresh access_token stored in httponlycookies

2021-05-08 Thread narendra thapa
Thank You @Michal Thomas, i was able to refresh a token now, But i got another confusion from your answer :D. Which is the best place to store a refresh token to make it secure? On Sat, May 8, 2021 at 12:20 PM Michael Thomas < michael.thomas.s...@gmail.com> wrote: > Generally speaking, storing a

Re: DRF simplejwt refresh access_token stored in httponlycookies

2021-05-07 Thread Michael Thomas
Generally speaking, storing a JWT token (especially a refresh token) as a cookie isn't the best thing to do, as it means you're potentially "leaking" the token in every request where that cookie is valid, rather than intentionally sending it as a header only when you intend to (among other issues).

DRF simplejwt refresh access_token stored in httponlycookies

2021-05-07 Thread narendra...@gmail.com
i'm using django as my backend and react as frontend. i'm using simplejwt for authentication. i can get access and refresh token and has stored in httponly cookies. now i'm not able to refresh a token. can somebody help me out? -- You received this message because you are subscribed to the Goo