I am creating a web app with Flask and Vue.js... I got everything working so far but when the access token expires, the refresh process doesn't work.
Cookies seem to be set in browser correctly:
Here is the important flask configuration:
...
app.config["JWT_TOKEN_LOCATION"] = ["cookies"]
app.config["JWT_ACCESS_CSRF_HEADER_NAME"] = "X-CSRF-TOKEN-ACCESS"
app.config["JWT_REFRESH_CSRF_HEADER_NAME"] = "X-CSRF-TOKEN-REFRESH"
...
@app.route("/api/refresh", methods=["POST"])
@jwt_required(refresh=True)
def refresh():
userid = get_jwt_identity()
user = User.query.filter_by(id=userid).first()
access_token = create_access_token(identity=user.id)
resp = jsonify()
set_access_cookies(resp, access_token)
return resp, 201
Here is the axios configuration in vue:
const authServ = axios.create({
baseURL: process.env.VUE_APP_AUTH_URL,
withCredentials: true,
xsrfCookieName: 'X-CSRF-TOKEN-ACCESS'
});
const COOKIE_EXPIRED_MSG = "Token has expired";
authServ.interceptors.response.use(resp => {
return resp;
}, async (error) => {
const error_msg = error.response.data.msg;
switch (error.response.status) {
case 401:
if (!error.config.retry && error_msg === COOKIE_EXPIRED_MSG) {
error.config.retry = true;
authServ.defaults.xsrfCookieName = 'X-CSRF-TOKEN-REFRESH';
await authServ.post('/refresh')
authServ.defaults.xsrfCookieName = 'X-CSRF-TOKEN-ACCESS';
return authServ(error.config);
}
break;
case 404:
await router.push('/404');
break;
default:
break;
}
return error.response;
});
EDIT 1: The error message in the browser:
Failed to load resource: the server responded with a status of 401 (UNAUTHORIZED)
EDIT 2: Fixed it by changing the method to GET, I would still like to know why though so if anyone has an idea... ^^