Changing Default Behaviors

We provide what we think are sensible behaviors when attempting to access a protected endpoint. If the JWT is not valid for any reason (missing, expired, tampered with, etc) we will return json in the format of {‘msg’: ‘why accessing endpoint failed’} along with an appropriate http status code (401 or 422). However, you may want to customize what you return in some situations. We can do that with the jwt_manager loader functions. An example of this looks like:

from flask import Flask, jsonify, request
from flask_jwt_simple import JWTManager, jwt_required, create_jwt

app = Flask(__name__)

app.config['JWT_SECRET_KEY'] = 'super-secret'  # Change this!
jwt = JWTManager(app)


# Using the expired_token_loader decorator, we will now call
# this function whenever an expired but otherwise valid access
# token attempts to access an endpoint. There are other
# behaviors tht can be changed with these loader functions.
# Check the docs for a full list.
@jwt.expired_token_loader
def my_expired_token_callback():
    err_json = {
        "status": 401,
        "title": "Expired JWT",
        "detail": "The JWT has expired"
    }
    return jsonify(err_json), 401


@app.route('/login', methods=['POST'])
def login():
    username = request.json.get('username', None)
    password = request.json.get('password', None)
    if username != 'test' or password != 'test':
        return jsonify({"msg": "Bad username or password"}), 401

    ret = {'access_token': create_jwt(username)}
    return jsonify(ret), 200


@app.route('/protected', methods=['GET'])
@jwt_required
def protected():
    return jsonify({'hello': 'world'}), 200

if __name__ == '__main__':
    app.run()

Possible loader functions are:

Loader Decorator	Description	Function Arguments
expired_token_loader	Function to call when an expired token accesses a protected endpoint	None
invalid_token_loader	Function to call when an invalid token accesses a protected endpoint	Takes one argument - an error string indicating why the token is invalid
unauthorized_loader	Function to call when a request with no JWT accesses a protected endpoint	Takes one argument - an error string indicating why the request in unauthorized