Skip to content

No way to pass request/view context to JWT token generation #720

Description

@AbhijithKonnayil

Summary

dj_rest_auth currently does not provide a supported way to pass request- or view-level context into JWT token generation.
This makes it difficult to add dynamic, request-scoped claims (e.g. client type, device info) to JWT tokens without overriding core views.

Current Behavior

In LoginView, JWT tokens are generated like this:

def login(self):
...
        if api_settings.USE_JWT:
            self.access_token, self.refresh_token = jwt_encode(self.user)
        elif token_model:
            self.token = api_settings.TOKEN_CREATOR(token_model, self.user, self.serializer)
...

The jwt_encode helper only accepts a user:

def jwt_encode(user):
    from dj_rest_auth.app_settings import api_settings

    JWTTokenClaimsSerializer = api_settings.JWT_TOKEN_CLAIMS_SERIALIZER

    refresh = JWTTokenClaimsSerializer.get_token(user)
    return refresh.access_token, refresh

Key observations:

  • jwt_encode only accepts user

  • get_token is a @classmethod

  • No access to:

    • request

    • serializer.context

    • headers or view-level data

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions