0

My Flask app i made is using flask-jwt-extended for JWT auth. As i followed this tutorial, i added email as indentity when created access token right here:

class ApiLogin(Resource):
    def post(self):
        data = loginParser.parse_args()
        current_user = User.find_by_email(data['email'])
        current_member = FamilyMember.find_by_email(data['email'])
        if not current_user or current_member:
            return {'message': 'User email {} doesn\'t exist'.format(data['email'])}, 403
        
        if bcrypt.check_password_hash(current_user.password if current_user else current_member.password, data['password']):
            access_token = create_access_token(identity =data['email'])
            refresh_token = create_refresh_token(identity =data['email'])
            print(get_raw_jwt())
            return {
                'message': 'Logged in as {}'.format(data['email']),
                'name': current_user.name if current_user else current_member.name,
                'access_token': access_token,
                'refresh_token': refresh_token,
                'identity': get_raw_jwt()
            }
        else:
            return {'message': 'Wrong credentials'}, 403

But the get_raw_jwt() function is returning id as identity instead of email like this:

{'iat': 1594408603, 'nbf': 1594408603, 'jti': '1b7227e5-873e-4076-aac6-a81ec2834256', 'exp': 1597000603, 'identity': 2, 'fresh': False, 'type': 'access', 'user_claims': {}}

How come this happened? Spent hours googling but come up with no similar result. Please tell me at which part i do a mistake

Vicky Sultan
  • 73
  • 2
  • 15

1 Answers1

0

get_raw_jwt() returns the identity of the token making the request, not of the newly created token you just created. Your return statement should look like this:

return {
    'message': 'Logged in as {}'.format(data['email']),
    'name': current_user.name if current_user else current_member.name,
    'access_token': access_token,
    'refresh_token': refresh_token,
    'identity': data['email'],
}
vimalloc
  • 3,869
  • 4
  • 32
  • 45
  • Sorry for not making it clear, i call the ````get_raw_jwt()```` on other request, not on that after login, and the result is still showing my id, not the email – Vicky Sultan Jul 11 '20 at 19:41