{"action":"created","issue":{"url":"https://api.github.com/repos/davesque/django-rest-framework-simplejwt/issues/21","repository_url":"https://api.github.com/repos/davesque/django-rest-framework-simplejwt","labels_url":"https://api.github.com/repos/davesque/django-rest-framework-simplejwt/issues/21/labels{/name}","comments_url":"https://api.github.com/repos/davesque/django-rest-framework-simplejwt/issues/21/comments","events_url":"https://api.github.com/repos/davesque/django-rest-framework-simplejwt/issues/21/events","html_url":"https://github.com/davesque/django-rest-framework-simplejwt/issues/21","id":317166951,"node_id":"MDU6SXNzdWUzMTcxNjY5NTE=","number":21,"title":"TokenRefreshSlidingSerializer verifies exp claim when constructing SlidingToken","user":{"login":"bitdivision","id":205209,"node_id":"MDQ6VXNlcjIwNTIwOQ==","avatar_url":"https://avatars2.githubusercontent.com/u/205209?v=4","gravatar_id":"","url":"https://api.github.com/users/bitdivision","html_url":"https://github.com/bitdivision","followers_url":"https://api.github.com/users/bitdivision/followers","following_url":"https://api.github.com/users/bitdivision/following{/other_user}","gists_url":"https://api.github.com/users/bitdivision/gists{/gist_id}","starred_url":"https://api.github.com/users/bitdivision/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bitdivision/subscriptions","organizations_url":"https://api.github.com/users/bitdivision/orgs","repos_url":"https://api.github.com/users/bitdivision/repos","events_url":"https://api.github.com/users/bitdivision/events{/privacy}","received_events_url":"https://api.github.com/users/bitdivision/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2018-04-24T10:34:38Z","updated_at":"2018-07-14T22:33:59Z","closed_at":null,"author_association":"NONE","body":"From the documentation in the readme:\r\n>Additionally, as long as the timestamp in its refresh expiration claim has not passed, it may also be submitted to a refresh view to get another copy of itself with a renewed expiration claim.\r\n\r\nThis documentation doesn't seem to match what is happening in the code. The expiration claim is being checked even though only the refresh claim should matter.\r\n\r\nThe `TokenRefreshSlidingSerializer` serializer creates an instance of `SlidingToken` and then checks the refresh claim expiry. The constructor of `SlidingToken` calls the `__init__` method of `Token` which tries to verify the exp claim of the token and raises a 401 if it isn't valid.\r\n\r\nAs far as I can see, the `SlidingToken` constructor should be passed `verify=False` to avoid verifying the `exp` claim, since only the refresh claim should matter in this particular serializer. \r\n\r\nAre there any other concerns with passing `verify=False` to the constructor?"},"comment":{"url":"https://api.github.com/repos/davesque/django-rest-framework-simplejwt/issues/comments/405054177","html_url":"https://github.com/davesque/django-rest-framework-simplejwt/issues/21#issuecomment-405054177","issue_url":"https://api.github.com/repos/davesque/django-rest-framework-simplejwt/issues/21","id":405054177,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNTA1NDE3Nw==","user":{"login":"davesque","id":791437,"node_id":"MDQ6VXNlcjc5MTQzNw==","avatar_url":"https://avatars2.githubusercontent.com/u/791437?v=4","gravatar_id":"","url":"https://api.github.com/users/davesque","html_url":"https://github.com/davesque","followers_url":"https://api.github.com/users/davesque/followers","following_url":"https://api.github.com/users/davesque/following{/other_user}","gists_url":"https://api.github.com/users/davesque/gists{/gist_id}","starred_url":"https://api.github.com/users/davesque/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davesque/subscriptions","organizations_url":"https://api.github.com/users/davesque/orgs","repos_url":"https://api.github.com/users/davesque/repos","events_url":"https://api.github.com/users/davesque/events{/privacy}","received_events_url":"https://api.github.com/users/davesque/received_events","type":"User","site_admin":false},"created_at":"2018-07-14T22:33:59Z","updated_at":"2018-07-14T22:33:59Z","author_association":"OWNER","body":"I don't agree that sliding tokens should be usable if the \"exp\" claim is expired.  Otherwise, what's the point of using a sliding token?  Why not just set the `SLIDING_TOKEN_LIFETIME` claim to some long duration and forego refreshing tokens at all?  The idea with sliding tokens is that you can have a person be logged in for up to a certain length of time as long as they're active within a different length of time.  I think what should happen is that the docs should be updated to clarify that this is the behavior."}}
{"actor":{"display_login":"davesque"}}