title: Django REST: How do i return SimpleJWT access and refresh tokens as HttpOnly cookies with custom claims?
body: <p>I want to send the <code>SimpleJWT</code> <code>access</code> and <code>refresh</code> tokens through <code>HttpOnly</code> cookie. I have customized the claim. I have defined a <code>post()</code> method in the <code>MyObtainTokenPairView(TokenObtainPairView)</code> in which I am setting the cookie. This is my code:</p>
  <pre><code>from .models import CustomUser
  
  class MyObtainTokenPairView(TokenObtainPairView):
      permission_classes = (permissions.AllowAny,)
      serializer_class = MyTokenObtainPairSerializer
      
      def post(self, request, *args, **kwargs):
          serializer = self.serializer_class()
          response = Response()
          tokens = serializer.get_token(CustomUser)
          access = tokens.access
          response.set_cookie('token', access, httponly=True)
          return response   
  </code></pre>
  <p>It's returning this error:</p>
  <pre><code>AttributeError: 'RefreshToken' object has no attribute 'access'
  </code></pre>
  <p>The serializer:</p>
  <pre><code>class MyTokenObtainPairSerializer(TokenObtainPairSerializer):
      
      @classmethod
      def get_token(cls, user):
          print(type(user))
          token = super().get_token(user)
          token['email'] = user.email
          return token
  </code></pre>
  <p>But it's just not working. I think I should not define a <code>post()</code> method here like this. I think if I can only return the value of the <code>get_token()</code> function in the serializer, I could set it as <code>HttpOnly</code> cookie. But, I don't know how to do that.</p>
  <p>How do I set the <code>access</code> and <code>refresh</code> tokens in the <code>HttpOnly</code> cookie?</p>
  <p><strong>EDIT:</strong>
  I made these changes following <strong>anowlinorbit</strong>'s answer:</p>
  <p>I changed my serializer to this:</p>
  <pre><code>class MyTokenObtainPairSerializer(TokenObtainPairSerializer):
      
      def validate(self, attrs):
          attrs = super().validate(attrs)
          token = self.get_token(self.user)
          token[&quot;email&quot;] = self.user.email
          return token
  </code></pre>
  <p>Since this token contains the refresh token by default therefore, I decided that returning only this <code>token</code> would provide  both <code>access</code> and <code>refresh</code> token.
  If I add anything like <code>token[&quot;access&quot;] = str(token.access_token)</code> it would just add the access token string inside the refresh token string, which it already contains.</p>
  <p>But again in the view, I could not find how to get the refresh token. I could not get it using <code>serializer.validated_data.get('refresh', None)</code> since now I am returning the <code>token</code> from serializer which contains everything.</p>
  <p>I changed my view to this:</p>
  <pre><code>class MyObtainTokenPairView(TokenObtainPairView):
      permission_classes = (permissions.AllowAny,)
      serializer_class = MyTokenObtainPairSerializer
      
      def post(self, request, *args, **kwargs):
          response = super().post(request, *args, **kwargs)
          response.set_cookie('token', token, httponly=True)
          return response
  </code></pre>
  <p>Now it's saying:</p>
  <pre><code>NameError: name 'token' is not defined
  </code></pre>
  <p>What's wrong here? In the view I want to get the <code>token</code> returned from serializer, then get the acces token using <code>token.access_token</code> and set both <code>refresh</code> and <code>access</code> as cookies.</p>