Month: June 2024

To change the expiration dates for access and refresh tokens when using Django Simple JWT, you can configure the settings in your Django project’s settings file (settings.py). Here’s how you can do it:

1. Install Simple JWT (if not already installed):

   pip install djangorestframework-simplejwt
   

2. Update settings.py to include Simple JWT settings:

   from datetime import timedelta
   
   SIMPLE_JWT = {
       'ACCESS_TOKEN_LIFETIME': timedelta(minutes=5),  # Change this to your desired lifetime
       'REFRESH_TOKEN_LIFETIME': timedelta(days=1),  # Change this to your desired lifetime
       'ROTATE_REFRESH_TOKENS': False,
       'BLACKLIST_AFTER_ROTATION': True,
       'UPDATE_LAST_LOGIN': False,
   
       'ALGORITHM': 'HS256',
       'SIGNING_KEY': SECRET_KEY,
       'VERIFYING_KEY': None,
       'AUDIENCE': None,
       'ISSUER': None,
   
       'AUTH_HEADER_TYPES': ('Bearer',),
       'USER_ID_FIELD': 'id',
       'USER_ID_CLAIM': 'user_id',
       'AUTH_TOKEN_CLASSES': ('rest_framework_simplejwt.tokens.AccessToken',),
       'TOKEN_TYPE_CLAIM': 'token_type',
   
       'JTI_CLAIM': 'jti',
   
       'SLIDING_TOKEN_REFRESH_EXP_CLAIM': 'refresh_exp',
       'SLIDING_TOKEN_LIFETIME': timedelta(minutes=5),
       'SLIDING_TOKEN_REFRESH_LIFETIME': timedelta(days=1),
   }
   

3. Update the REST_FRAMEWORK settings to use Simple JWT as the authentication class:

   REST_FRAMEWORK = {
       'DEFAULT_AUTHENTICATION_CLASSES': (
           'rest_framework_simplejwt.authentication.JWTAuthentication',
       ),
   }
   

Example

If you want to set the access token to expire in 15 minutes and the refresh token to expire in 7 days, you would update your settings.py as follows:

from datetime import timedelta

SIMPLE_JWT = {
    'ACCESS_TOKEN_LIFETIME': timedelta(minutes=15),
    'REFRESH_TOKEN_LIFETIME': timedelta(days=7),
    'ROTATE_REFRESH_TOKENS': False,
    'BLACKLIST_AFTER_ROTATION': True,
    'UPDATE_LAST_LOGIN': False,

    'ALGORITHM': 'HS256',
    'SIGNING_KEY': SECRET_KEY,
    'VERIFYING_KEY': None,
    'AUDIENCE': None,
    'ISSUER': None,

    'AUTH_HEADER_TYPES': ('Bearer',),
    'USER_ID_FIELD': 'id',
    'USER_ID_CLAIM': 'user_id',
    'AUTH_TOKEN_CLASSES': ('rest_framework_simplejwt.tokens.AccessToken',),
    'TOKEN_TYPE_CLAIM': 'token_type',

    'JTI_CLAIM': 'jti',

    'SLIDING_TOKEN_REFRESH_EXP_CLAIM': 'refresh_exp',
    'SLIDING_TOKEN_LIFETIME': timedelta(minutes=15),
    'SLIDING_TOKEN_REFRESH_LIFETIME': timedelta(days=7),
}

These settings will ensure that your access tokens expire after 15 minutes and refresh tokens expire after 7 days. Adjust the timedelta values as needed for your application’s requirements.

Adding a custom claim to the JSON Web Tokens (JWT) in Django using the django-simple-jwt library involves extending the token creation process to include additional information. Here’s how you can achieve this:

1. Install the necessary libraries: Make sure you have djangorestframework and djangorestframework-simplejwt installed.

   pip install djangorestframework djangorestframework-simplejwt
   

2. Update your Django settings: Configure django-simple-jwt in your settings.py file.

   INSTALLED_APPS = [
       ...
       'rest_framework',
       'rest_framework_simplejwt',
   ]
   
   REST_FRAMEWORK = {
       'DEFAULT_AUTHENTICATION_CLASSES': (
           'rest_framework_simplejwt.authentication.JWTAuthentication',
       ),
   }
   

3. Create a custom claims serializer: Extend the TokenObtainPairSerializer to include your custom claim.

   from rest_framework_simplejwt.serializers import TokenObtainPairSerializer
   
   class MyTokenObtainPairSerializer(TokenObtainPairSerializer):
   
       def get_token(self, user):
           token = super().get_token(user)
   
           # Add custom claims
           token['custom_claim'] = 'custom_value'
           
           # Example: Add user's email to the token
           token['email'] = user.email
   
           return token
   

4. Create a custom view: Use the custom serializer in your view.

   from rest_framework_simplejwt.views import TokenObtainPairView
   from .serializers import MyTokenObtainPairSerializer
   
   class MyTokenObtainPairView(TokenObtainPairView):
       serializer_class = MyTokenObtainPairSerializer
   

5. Update your URLs: Include the custom view in your URL configuration.

   from django.urls import path
   from .views import MyTokenObtainPairView
   from rest_framework_simplejwt.views import TokenRefreshView
   
   urlpatterns = [
       path('api/token/', MyTokenObtainPairView.as_view(), name='token_obtain_pair'),
       path('api/token/refresh/', TokenRefreshView.as_view(), name='token_refresh'),
   ]
   

6. Test your custom claim: Now when you obtain a token, it should include your custom claim.