{"action":"opened","issue":{"url":"https://api.github.com/repos/ahopkins/sanic-jwt/issues/52","repository_url":"https://api.github.com/repos/ahopkins/sanic-jwt","labels_url":"https://api.github.com/repos/ahopkins/sanic-jwt/issues/52/labels{/name}","comments_url":"https://api.github.com/repos/ahopkins/sanic-jwt/issues/52/comments","events_url":"https://api.github.com/repos/ahopkins/sanic-jwt/issues/52/events","html_url":"https://github.com/ahopkins/sanic-jwt/issues/52","id":293470960,"number":52,"title":"Thoughts on how to refresh","user":{"login":"ahopkins","id":166269,"avatar_url":"https://avatars1.githubusercontent.com/u/166269?v=4","gravatar_id":"","url":"https://api.github.com/users/ahopkins","html_url":"https://github.com/ahopkins","followers_url":"https://api.github.com/users/ahopkins/followers","following_url":"https://api.github.com/users/ahopkins/following{/other_user}","gists_url":"https://api.github.com/users/ahopkins/gists{/gist_id}","starred_url":"https://api.github.com/users/ahopkins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ahopkins/subscriptions","organizations_url":"https://api.github.com/users/ahopkins/orgs","repos_url":"https://api.github.com/users/ahopkins/repos","events_url":"https://api.github.com/users/ahopkins/events{/privacy}","received_events_url":"https://api.github.com/users/ahopkins/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-01T10:06:54Z","updated_at":"2018-02-01T10:06:54Z","closed_at":null,"author_association":"OWNER","body":"Right now, you are required to send the access token and the refresh token. \r\n\r\nWhy? Well, it seems like a good idea to facilitate the lookup of refresh tokens by knowing against which user you are *trying* to look up. It seems like another layer (albeit thin) of security. The alternative is to lookup the user by refresh token alone. \r\n\r\nIn the current operation, there is **NO** verification of the JWT at this stage while refreshing, it is used ONLY to pass the payload and get the intended `user_id`.\r\n\r\nI think this is probably the best method, but I am open to thoughts on whether this should change. Perhaps it could be configurable."}}
{"actor":{"display_login":"ahopkins"}}