@@ -30,24 +30,25 @@ def test_encode_access_token(self):
30
30
algorithm = 'HS256'
31
31
token_expire_delta = timedelta (minutes = 5 )
32
32
user_claims = {'foo' : 'bar' }
33
+ identity_claim = 'identity'
33
34
34
35
# Check with a fresh token
35
36
with self .app .test_request_context ():
36
37
identity = 'user1'
37
38
token = encode_access_token (identity , secret , algorithm , token_expire_delta ,
38
39
fresh = True , user_claims = user_claims , csrf = False ,
39
- identity_claim = 'identity' )
40
+ identity_claim = identity_claim )
40
41
data = jwt .decode (token , secret , algorithms = [algorithm ])
41
42
self .assertIn ('exp' , data )
42
43
self .assertIn ('iat' , data )
43
44
self .assertIn ('nbf' , data )
44
45
self .assertIn ('jti' , data )
45
- self .assertIn ('identity' , data )
46
+ self .assertIn (identity_claim , data )
46
47
self .assertIn ('fresh' , data )
47
48
self .assertIn ('type' , data )
48
49
self .assertIn ('user_claims' , data )
49
50
self .assertNotIn ('csrf' , data )
50
- self .assertEqual (data ['identity' ], identity )
51
+ self .assertEqual (data [identity_claim ], identity )
51
52
self .assertEqual (data ['fresh' ], True )
52
53
self .assertEqual (data ['type' ], 'access' )
53
54
self .assertEqual (data ['user_claims' ], user_claims )
@@ -61,18 +62,18 @@ def test_encode_access_token(self):
61
62
identity = 12345 # identity can be anything json serializable
62
63
token = encode_access_token (identity , secret , algorithm , token_expire_delta ,
63
64
fresh = False , user_claims = user_claims , csrf = True ,
64
- identity_claim = 'identity' )
65
+ identity_claim = identity_claim )
65
66
data = jwt .decode (token , secret , algorithms = [algorithm ])
66
67
self .assertIn ('exp' , data )
67
68
self .assertIn ('iat' , data )
68
69
self .assertIn ('nbf' , data )
69
70
self .assertIn ('jti' , data )
70
- self .assertIn ('identity' , data )
71
+ self .assertIn (identity_claim , data )
71
72
self .assertIn ('fresh' , data )
72
73
self .assertIn ('type' , data )
73
74
self .assertIn ('user_claims' , data )
74
75
self .assertIn ('csrf' , data )
75
- self .assertEqual (data ['identity' ], identity )
76
+ self .assertEqual (data [identity_claim ], identity )
76
77
self .assertEqual (data ['fresh' ], False )
77
78
self .assertEqual (data ['type' ], 'access' )
78
79
self .assertEqual (data ['user_claims' ], user_claims )
@@ -86,16 +87,17 @@ def test_encode_invalid_access_token(self):
86
87
# Check with non-serializable json
87
88
with self .app .test_request_context ():
88
89
user_claims = datetime
90
+ identity_claim = 'identity'
89
91
with self .assertRaises (Exception ):
90
92
encode_access_token ('user1' , 'secret' , 'HS256' ,
91
93
timedelta (hours = 1 ), True , user_claims ,
92
- csrf = True , identity_claim = 'identity' )
94
+ csrf = True , identity_claim = identity_claim )
93
95
94
96
user_claims = {'foo' : timedelta (hours = 4 )}
95
97
with self .assertRaises (Exception ):
96
98
encode_access_token ('user1' , 'secret' , 'HS256' ,
97
99
timedelta (hours = 1 ), True , user_claims ,
98
- csrf = True , identity_claim = 'identity' )
100
+ csrf = True , identity_claim = identity_claim )
99
101
100
102
def test_encode_refresh_token (self ):
101
103
secret = 'super-totally-secret-key'
@@ -212,25 +214,27 @@ def test_decode_jwt(self):
212
214
213
215
def test_decode_invalid_jwt (self ):
214
216
with self .app .test_request_context ():
217
+ identity_claim = 'identity'
215
218
# Verify underlying pyjwt expires verification works
216
219
with self .assertRaises (jwt .ExpiredSignatureError ):
217
220
token_data = {
218
221
'exp' : datetime .utcnow () - timedelta (minutes = 5 ),
219
222
}
220
223
encoded_token = jwt .encode (token_data , 'secret' , 'HS256' ).decode ('utf-8' )
221
224
decode_jwt (encoded_token , 'secret' , 'HS256' ,
222
- csrf = False , identity_claim = 'identity' )
225
+ csrf = False , identity_claim = identity_claim )
223
226
224
227
# Missing jti
225
228
with self .assertRaises (JWTDecodeError ):
229
+
226
230
token_data = {
227
231
'exp' : datetime .utcnow () + timedelta (minutes = 5 ),
228
- 'identity' : 'banana' ,
232
+ identity_claim : 'banana' ,
229
233
'type' : 'refresh'
230
234
}
231
235
encoded_token = jwt .encode (token_data , 'secret' , 'HS256' ).decode ('utf-8' )
232
236
decode_jwt (encoded_token , 'secret' , 'HS256' ,
233
- csrf = False , identity_claim = 'identity' )
237
+ csrf = False , identity_claim = identity_claim )
234
238
235
239
# Missing identity
236
240
with self .assertRaises (JWTDecodeError ):
@@ -241,83 +245,85 @@ def test_decode_invalid_jwt(self):
241
245
}
242
246
encoded_token = jwt .encode (token_data , 'secret' , 'HS256' ).decode ('utf-8' )
243
247
decode_jwt (encoded_token , 'secret' , 'HS256' ,
244
- csrf = False , identity_claim = 'identity' )
248
+ csrf = False , identity_claim = identity_claim )
245
249
246
250
# Non-matching identity claim
247
251
with self .assertRaises (JWTDecodeError ):
248
252
token_data = {
249
253
'exp' : datetime .utcnow () + timedelta (minutes = 5 ),
250
- 'identity' : 'banana' ,
254
+ identity_claim : 'banana' ,
251
255
'type' : 'refresh'
252
256
}
257
+ other_identity_claim = 'sub'
253
258
encoded_token = jwt .encode (token_data , 'secret' , 'HS256' ).decode ('utf-8' )
259
+ self .assertNotEqual (identity_claim , other_identity_claim )
254
260
decode_jwt (encoded_token , 'secret' , 'HS256' ,
255
- csrf = False , identity_claim = 'sub' )
261
+ csrf = False , identity_claim = other_identity_claim )
256
262
257
263
# Missing type
258
264
with self .assertRaises (JWTDecodeError ):
259
265
token_data = {
260
266
'jti' : 'banana' ,
261
- 'identity' : 'banana' ,
267
+ identity_claim : 'banana' ,
262
268
'exp' : datetime .utcnow () + timedelta (minutes = 5 ),
263
269
}
264
270
encoded_token = jwt .encode (token_data , 'secret' , 'HS256' ).decode ('utf-8' )
265
271
decode_jwt (encoded_token , 'secret' , 'HS256' ,
266
- csrf = False , identity_claim = 'identity' )
272
+ csrf = False , identity_claim = identity_claim )
267
273
268
274
# Missing fresh in access token
269
275
with self .assertRaises (JWTDecodeError ):
270
276
token_data = {
271
277
'jti' : 'banana' ,
272
- 'identity' : 'banana' ,
278
+ identity_claim : 'banana' ,
273
279
'exp' : datetime .utcnow () + timedelta (minutes = 5 ),
274
280
'type' : 'access' ,
275
281
'user_claims' : {}
276
282
}
277
283
encoded_token = jwt .encode (token_data , 'secret' , 'HS256' ).decode ('utf-8' )
278
284
decode_jwt (encoded_token , 'secret' , 'HS256' ,
279
- csrf = False , identity_claim = 'identity' )
285
+ csrf = False , identity_claim = identity_claim )
280
286
281
287
# Missing user claims in access token
282
288
with self .assertRaises (JWTDecodeError ):
283
289
token_data = {
284
290
'jti' : 'banana' ,
285
- 'identity' : 'banana' ,
291
+ identity_claim : 'banana' ,
286
292
'exp' : datetime .utcnow () + timedelta (minutes = 5 ),
287
293
'type' : 'access' ,
288
294
'fresh' : True
289
295
}
290
296
encoded_token = jwt .encode (token_data , 'secret' , 'HS256' ).decode ('utf-8' )
291
297
decode_jwt (encoded_token , 'secret' , 'HS256' ,
292
- csrf = False , identity_claim = 'identity' )
298
+ csrf = False , identity_claim = identity_claim )
293
299
294
300
# Bad token type
295
301
with self .assertRaises (JWTDecodeError ):
296
302
token_data = {
297
303
'jti' : 'banana' ,
298
- 'identity' : 'banana' ,
304
+ identity_claim : 'banana' ,
299
305
'exp' : datetime .utcnow () + timedelta (minutes = 5 ),
300
306
'type' : 'banana' ,
301
307
'fresh' : True ,
302
308
'user_claims' : 'banana'
303
309
}
304
310
encoded_token = jwt .encode (token_data , 'secret' , 'HS256' ).decode ('utf-8' )
305
311
decode_jwt (encoded_token , 'secret' , 'HS256' ,
306
- csrf = False , identity_claim = 'identity' )
312
+ csrf = False , identity_claim = identity_claim )
307
313
308
314
# Missing csrf in csrf enabled token
309
315
with self .assertRaises (JWTDecodeError ):
310
316
token_data = {
311
317
'jti' : 'banana' ,
312
- 'identity' : 'banana' ,
318
+ identity_claim : 'banana' ,
313
319
'exp' : datetime .utcnow () + timedelta (minutes = 5 ),
314
320
'type' : 'access' ,
315
321
'fresh' : True ,
316
322
'user_claims' : 'banana'
317
323
}
318
324
encoded_token = jwt .encode (token_data , 'secret' , 'HS256' ).decode ('utf-8' )
319
325
decode_jwt (encoded_token , 'secret' , 'HS256' , csrf = True ,
320
- identity_claim = 'identity' )
326
+ identity_claim = identity_claim )
321
327
322
328
def test_create_jwt_with_object (self ):
323
329
# Complex object to test building a JWT from. Normally if you are using
0 commit comments