Skip to content
This repository was archived by the owner on May 26, 2020. It is now read-only.

Commit 0f2993c

Browse files
committed
Updated the documentation to explain use of the verification endpoint.
1 parent f0a0a89 commit 0f2993c

File tree

1 file changed

+15
-0
lines changed

1 file changed

+15
-0
lines changed

docs/index.md

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,21 @@ Refresh with tokens can be repeated (token1 -> token2 -> token3), but this chain
101101

102102
A typical use case might be a web app where you'd like to keep the user "logged in" the site without having to re-enter their password, or get kicked out by surprise before their token expired. Imagine they had a 1-hour token and are just at the last minute while they're still doing something. With mobile you could perhaps store the username/password to get a new token, but this is not a great idea in a browser. Each time the user loads the page, you can check if there is an existing non-expired token and if it's close to being expired, refresh it to extend their session. In other words, if a user is actively using your site, they can keep their "session" alive.
103103

104+
## Verify Token
105+
106+
In some microservice architectures, authentication is handled by a single service. Other services delegate the responsibility of confirming that a user is logged in to this authentication service. This usually means that a service will pass a JWT received from the user to the authentication service, and wait for a confirmation that the JWT is valid before returning protected resources to the user.
107+
108+
This setup is supported in this package using a verification endpoint. Add the following URL pattern:
109+
```python
110+
url(r'^api-token-verify/', 'rest_framework_jwt.views.verify_jwt_token'),
111+
```
112+
113+
Passing a token to the verification endpoint will return a 200 response and the token if it is valid. Otherwise, it will return a 400 Bad Request as well as an error identifying why the token was invalid.
114+
115+
```bash
116+
$ curl -X POST -H "Content-Type: application/json" -d '{"token":"<EXISTING_TOKEN>"}' http://localhost:8000/api-token-verify/
117+
```
118+
104119
## Additional Settings
105120
There are some additional settings that you can override similar to how you'd do it with Django REST framework itself. Here are all the available defaults.
106121

0 commit comments

Comments
 (0)