Skip to content

Initialize request context for exempt methods in verify_jwt_in_request - #585

Open
saiyam-jain-dev wants to merge 1 commit into
vimalloc:mainfrom
saiyam-jain-dev:fix-options-request-context
Open

saiyam-jain-dev wants to merge 1 commit into
vimalloc:mainfrom
saiyam-jain-dev:fix-options-request-context

Conversation

@saiyam-jain-dev

Copy link
Copy Markdown

Fixes #475

Description

When a request method is in config.exempt_methods (default: ['OPTIONS']), verify_jwt_in_request() previously returned None immediately without populating g._jwt_extended_jwt or related context keys. When view handlers or @app.before_request hooks accessed get_jwt_identity(), get_jwt(), or current_user, a RuntimeError was raised saying @jwt_required() was not called even though the endpoint was decorated.

In addition, when optional=True was used on an exempt method, it short-circuited rather than decoding any token present in the request or safely defaulting when no token was provided.

This PR:

  1. Initializes g._jwt_extended_jwt = {}, g._jwt_extended_jwt_header = {}, and g._jwt_extended_jwt_user = {"loaded_user": None} when short-circuiting on exempt methods so get_jwt_identity() returns None instead of raising a RuntimeError.
  2. Avoids early return for exempt methods when optional=True, allowing any passed JWT to be decoded while falling back cleanly to None if no authorization header is present.
  3. Adds unit tests covering OPTIONS requests on both required and optional endpoints.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

@jwt_required does not work with the OPTIONS method

1 participant