{"action":"created","issue":{"url":"https://api.github.com/repos/waiting-for-dev/devise-jwt/issues/118","repository_url":"https://api.github.com/repos/waiting-for-dev/devise-jwt","labels_url":"https://api.github.com/repos/waiting-for-dev/devise-jwt/issues/118/labels{/name}","comments_url":"https://api.github.com/repos/waiting-for-dev/devise-jwt/issues/118/comments","events_url":"https://api.github.com/repos/waiting-for-dev/devise-jwt/issues/118/events","html_url":"https://github.com/waiting-for-dev/devise-jwt/issues/118","id":387838298,"node_id":"MDU6SXNzdWUzODc4MzgyOTg=","number":118,"title":"Is there a way to revoke a token from a controller?","user":{"login":"glapworth","id":1893918,"node_id":"MDQ6VXNlcjE4OTM5MTg=","avatar_url":"https://avatars0.githubusercontent.com/u/1893918?v=4","gravatar_id":"","url":"https://api.github.com/users/glapworth","html_url":"https://github.com/glapworth","followers_url":"https://api.github.com/users/glapworth/followers","following_url":"https://api.github.com/users/glapworth/following{/other_user}","gists_url":"https://api.github.com/users/glapworth/gists{/gist_id}","starred_url":"https://api.github.com/users/glapworth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/glapworth/subscriptions","organizations_url":"https://api.github.com/users/glapworth/orgs","repos_url":"https://api.github.com/users/glapworth/repos","events_url":"https://api.github.com/users/glapworth/events{/privacy}","received_events_url":"https://api.github.com/users/glapworth/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-12-05T16:27:29Z","updated_at":"2018-12-05T19:22:41Z","closed_at":null,"author_association":"NONE","body":"Since devise-jwt doesn't yet support refreshing tokens, I've put together a very simple solution:\r\n\r\n```\r\njwt.dispatch_requests = [\r\n        ['POST', %r{^/auth/sign_in$}],\r\n        ['GET', %r{^/auth/tokens/refresh$}],\r\n    ]\r\n```\r\n\r\nI've created a controller action to compliment it:\r\n\r\n```\r\nclass Auth::TokensController < ApplicationController\r\n  before_action :authenticate_account!\r\n\r\n  def refresh\r\n    self.status        = 200\r\n    self.content_type  = 'application/json'\r\n    self.response_body = { data: [{ status: '200' }]}.to_json\r\n  end\r\nend\r\n```\r\n\r\nIn my front end application, I watch for the expiry of the token, and when it's getting close, I call the endpoint `/auth/tokens/refresh` which generates me a new token.\r\n\r\nI wonder if there is a way to kill the current token sent in the Authorization header when the user makes the request to `/auth/token/refresh'?  I\r\n\r\nI've tried calling `Warden::JWTAuth::TokenRevoker.new.call(request.headers['Authorization'])` but that either stops execution during the refresh action, or it throws an exception : `JWT::DecodeError: Invalid segment encoding`.\r\n\r\nThanks for your help.\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/waiting-for-dev/devise-jwt/issues/comments/444610159","html_url":"https://github.com/waiting-for-dev/devise-jwt/issues/118#issuecomment-444610159","issue_url":"https://api.github.com/repos/waiting-for-dev/devise-jwt/issues/118","id":444610159,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NDYxMDE1OQ==","user":{"login":"waiting-for-dev","id":52650,"node_id":"MDQ6VXNlcjUyNjUw","avatar_url":"https://avatars1.githubusercontent.com/u/52650?v=4","gravatar_id":"","url":"https://api.github.com/users/waiting-for-dev","html_url":"https://github.com/waiting-for-dev","followers_url":"https://api.github.com/users/waiting-for-dev/followers","following_url":"https://api.github.com/users/waiting-for-dev/following{/other_user}","gists_url":"https://api.github.com/users/waiting-for-dev/gists{/gist_id}","starred_url":"https://api.github.com/users/waiting-for-dev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/waiting-for-dev/subscriptions","organizations_url":"https://api.github.com/users/waiting-for-dev/orgs","repos_url":"https://api.github.com/users/waiting-for-dev/repos","events_url":"https://api.github.com/users/waiting-for-dev/events{/privacy}","received_events_url":"https://api.github.com/users/waiting-for-dev/received_events","type":"User","site_admin":false},"created_at":"2018-12-05T19:22:41Z","updated_at":"2018-12-05T19:22:41Z","author_association":"OWNER","body":"Thanks for sharing your work. My view is that `devise-jwt` won't ever support refresh tokens, because there are better options for that, but anyway it can be helpful.\r\n\r\n> I wonder if there is a way to kill the current token sent in the Authorization header when the user makes the request to `/auth/token/refresh'?\r\n\r\nIf I understand you well, you can add that request to [`revocation_requests`](https://github.com/waiting-for-dev/devise-jwt/#revocation_requests)."}}
{"actor":{"display_login":"waiting-for-dev"}}