Я пытаюсь использовать Flask_JWT_Extended для защиты своего API. Если я отправлю запрос через swagger с localhost / api на localhost / api / auth / check, он сработает. Но если я попытаюсь отправить его через JavaScript с 'localhost / CheckAuth. js', JWT Extended сообщит, что куча access_token ie не найден.
Почему это происходит и как могу я это исправить?
My FLask Settings
# JWT settings
JWT_TOKEN_LOCATION = 'cookies'
JWT_COOKIE_SECURE = False
JWT_ACCESS_COOKIE_PATH = '127.0.0.1'
JWT_REFRESH_COOKIE_PATH = '/api/auth/refresh'
JWT_COOKIE_CSRF_PROTECT = False
JWT_SECRET_KEY = 'changeme'
my Auth.py, там логин и проверка определены
from flask import request, jsonify, make_response
from flask_restx import Resource
from api.mApi import api as marlinizer_api
from api.api_definition import login
from flask_jwt_extended import create_access_token, create_refresh_token, get_jwt_identity
from flask_jwt_extended import jwt_required, jwt_refresh_token_required
from flask_jwt_extended import set_access_cookies, set_refresh_cookies
from database.operations import Users
from misc import security
from flask import escape
namespace = marlinizer_api.namespace('auth')
@namespace.route('/login')
class Login(Resource):
@namespace.expect(login)
def post(self):
try:
username = escape(request.json['username'])
password = escape(request.json['password'])
user = Users.get_user_by_username(username)
if user is None or user['password'] !=
security.hash_user_password(str(password), str(user['salt'])):
data = dict(login=False)
return make_response(jsonify(**data), 200)
access_token = create_access_token(identity=username)
refresh_token = create_refresh_token(identity=username)
data = dict(login=True)
resp = make_response(jsonify(**data), 200)
set_access_cookies(resp, access_token)
set_refresh_cookies(resp, refresh_token)
return resp
except KeyError:
return '{"login": "false"}', 400
@namespace.route('/refresh')
class Refresh(Resource):
@jwt_refresh_token_required
def post(self):
user = get_jwt_identity()
access_token = create_access_token(identity=user)
data = dict(refresh=True)
resp = jsonify(**data)
set_access_cookies(resp, access_token)
return make_response(resp, 200)
@namespace.route('/check')
class CheckAuth(Resource):
@jwt_required
def get(self):
identity = get_jwt_identity()
user = Users.get_user_by_username(identity)
data = dict(auth=True)
if user is None:
data['auth'] = False
return make_response(jsonify(**data), 200)
The JavaScript
let client = new XMLHttpRequest();
client.open('GET', 'http://localhost:5000/api/auth/check');
client.onload = function (x) {
console.log(client.responseText);
}
client.setRequestHeader('Content-Type', 'application/json');
client.send('{}');