My current solution:
- Add last_jwt_iat field to User model
class User(AbstractUser):
id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
email = models.EmailField(unique=True, null=False, blank=False)
created_at = models.DateTimeField(auto_now_add=True)
updated_at = models.DateTimeField(auto_now=True)
last_jwt_iat = models.DateTimeField(null=True, blank=True)
def __str__(self):
return f'{self.email}'
- Subclassing graphql_jwt.relay.JSONWebTokenMutation, and update User.last_jwt_iat whenever new token is requested
class ObtainJSONWebToken(graphql_jwt.relay.JSONWebTokenMutation):
@classmethod
def resolve(cls, root, info, **kwargs):
# Update User.last_jwt_iat by generating current UTC timestamp
# Probably better if we can extract the origIat from GraphQL payload
user = info.context.user
last_jwt_iat = datetime.datetime.utcnow()
user.last_jwt_iat = last_jwt_iat
user.save()
return cls()
- Use Graphene middleware to check if User.last_jwt_iat > current JWT's iat
def _authenticate(request):
"""
Check if user is anonymous and JWT authorization header exist
:param request: HttpRequest instance
:return: Boolean
"""
is_anonymous = not hasattr(request, 'user') or request.user.is_anonymous
return is_anonymous and get_http_authorization(request) is not None
class AuthCheckIat(object):
def resolve(self, next, root, info, **args):
context = info.context
# Check if User.last_jwt_iat > token iat, raise error, stop evaluation
if _authenticate(context):
jwt_decoded = jwt_decode(get_http_authorization(context))
username = jwt_decoded['username']
user = User.objects.get(username=username)
iat = datetime.datetime.fromtimestamp(jwt_decoded['origIat'], tz=datetime.timezone.utc)
if user.last_jwt_iat > iat:
raise PermissionDenied(
'User last JWT issued time is greater than supplied JWT issued time. Please use newer token. ')
return next(root, info, **args)