-
Notifications
You must be signed in to change notification settings - Fork 9
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat[bckend-middleware]:Implemented custom middleware to check for blacklisted access tokens in Redis. #107
base: master
Are you sure you want to change the base?
Conversation
…acklisted access tokens in Redis.
185897d
to
d4c34e9
Compare
return self.get_response(request) | ||
token = auth_header.split()[1] | ||
token_obj = str(AccessToken(token)) | ||
redis_conn = get_redis_connection() |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Create a separate class for Redis in a separate file and implement the logic there.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
there should be separate file for redis config too and blacklisting refresh token too, I am thinking raising seperate PR for this , kinda chore/refactor tasks. I will put everything related to redis at one place.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
what is your view on this?
# Blacklist tokens in Redis | ||
refresh_exp_time = int(settings.SIMPLE_JWT['REFRESH_TOKEN_LIFETIME'].total_seconds()) | ||
access_exp_time = int(settings.SIMPLE_JWT['ACCESS_TOKEN_LIFETIME'].total_seconds()) | ||
with redis_conn.pipeline() as pipe: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Create a separate class for Redis in a separate file and implement the logic there.
This pull request introduces a custom middleware to check for blacklisted access tokens in Redis. The middleware intercepts incoming requests and verifies the validity of access tokens against a blacklist stored in Redis. If a token is found to be blacklisted, the middleware rejects the request with a 401 Unauthorized status code.
Summary
Depends on