Add @jwt_refresh_cookie decorator

docs/settings.rst

@@ -318,7 +318,14 @@ JWT_COOKIE_SAMESITE
 JWT_HIDE_TOKEN_FIELDS
 ~~~~~~~~~~~~~~~~~~~~~
 
-  For cookie-based authentications, remove the token fields from the GraphQL schema in order to prevent XSS exploitation
+  For cookie-based authentication using `@jwt_cookie` view decorator, remove the token and refresh token fields from the GraphQL schema in order to prevent XSS exploitation
+
+  Default: ``False``
+
+JWT_HIDE_REFRESH_TOKEN_FIELD
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+  For cookie-based authentication using `@jwt_refresh_cookie` view decorator, remove the refresh token field from the GraphQL schema in order to prevent XSS exploitation
 
   Default: ``False``
 

graphql_jwt/decorators.py

@@ -75,7 +75,7 @@ def on_token_auth_resolve(values):
     payload.token = jwt_settings.JWT_ENCODE_HANDLER(payload.payload, context)
 
     if jwt_settings.JWT_LONG_RUNNING_REFRESH_TOKEN:
-        if getattr(context, "jwt_cookie", False):
+        if getattr(context, "jwt_refresh_cookie", False):
             context.jwt_refresh_token = create_refresh_token(user)
             payload.refresh_token = context.jwt_refresh_token.get_token()
         else:
@@ -158,7 +158,7 @@ def jwt_cookie(view_func):
     @wraps(view_func)
     def wrapped_view(request, *args, **kwargs):
         request.jwt_cookie = True
-        response = view_func(request, *args, **kwargs)
+        response = jwt_refresh_cookie(view_func)(request, *args, **kwargs)
 
         if hasattr(request, "jwt_token"):
             expires = datetime.utcnow() + jwt_settings.JWT_EXPIRATION_DELTA
@@ -169,22 +169,31 @@ def wrapped_view(request, *args, **kwargs):
                 request.jwt_token,
                 expires=expires,
             )
-            if hasattr(request, "jwt_refresh_token"):
-                refresh_token = request.jwt_refresh_token
-                expires = (
-                    refresh_token.created + jwt_settings.JWT_REFRESH_EXPIRATION_DELTA
-                )
-
-                set_cookie(
-                    response,
-                    jwt_settings.JWT_REFRESH_TOKEN_COOKIE_NAME,
-                    refresh_token.token,
-                    expires=expires,
-                )
 
         if hasattr(request, "delete_jwt_cookie"):
             delete_cookie(response, jwt_settings.JWT_COOKIE_NAME)
 
+        return response
+
+    return wrapped_view
+
+
+def jwt_refresh_cookie(view_func):
+    @wraps(view_func)
+    def wrapped_view(request, *args, **kwargs):
+        request.jwt_refresh_cookie = True
+        response = view_func(request, *args, **kwargs)
+
+        if hasattr(request, "jwt_refresh_token"):
+            refresh_token = request.jwt_refresh_token
+            expires = refresh_token.created + jwt_settings.JWT_REFRESH_EXPIRATION_DELTA
+
+            set_cookie(
+                response,
+                jwt_settings.JWT_REFRESH_TOKEN_COOKIE_NAME,
+                refresh_token.token,
+                expires=expires,
+            )
         if hasattr(request, "delete_refresh_token_cookie"):
             delete_cookie(response, jwt_settings.JWT_REFRESH_TOKEN_COOKIE_NAME)
 

graphql_jwt/mixins.py

@@ -20,7 +20,10 @@ def Field(cls, *args, **kwargs):
         if not jwt_settings.JWT_HIDE_TOKEN_FIELDS:
             cls._meta.fields["token"] = graphene.Field(graphene.String, required=True)
 
-            if jwt_settings.JWT_LONG_RUNNING_REFRESH_TOKEN:
+            if (
+                jwt_settings.JWT_LONG_RUNNING_REFRESH_TOKEN
+                and not jwt_settings.JWT_HIDE_REFRESH_TOKEN_FIELD
+            ):
                 cls._meta.fields["refresh_token"] = graphene.Field(
                     graphene.String,
                     required=True,

graphql_jwt/refresh_token/mixins.py

@@ -35,13 +35,10 @@ def on_resolve(values):
         if old_refresh_token.is_expired(context):
             raise exceptions.JSONWebTokenError(_("Refresh token is expired"))
 
-        payload = jwt_settings.JWT_PAYLOAD_HANDLER(
-            old_refresh_token.user,
-            context,
-        )
+        payload = jwt_settings.JWT_PAYLOAD_HANDLER(old_refresh_token.user, context)
         token = jwt_settings.JWT_ENCODE_HANDLER(payload, context)
 
-        if getattr(context, "jwt_cookie", False):
+        if getattr(context, "jwt_refresh_cookie", False):
             context.jwt_refresh_token = create_refresh_token(
                 old_refresh_token.user,
                 old_refresh_token,
@@ -83,6 +80,6 @@ def delete_cookie(cls, root, info, **kwargs):
         context = info.context
         context.delete_refresh_token_cookie = (
             jwt_settings.JWT_REFRESH_TOKEN_COOKIE_NAME in context.COOKIES
-            and getattr(context, "jwt_cookie", False)
+            and getattr(context, "jwt_refresh_cookie", False)
         )
         return cls(deleted=context.delete_refresh_token_cookie)

graphql_jwt/settings.py

@@ -41,6 +41,7 @@
     "JWT_ALLOW_ANY_CLASSES": (),
     "JWT_CSRF_ROTATION": False,
     "JWT_HIDE_TOKEN_FIELDS": False,
+    "JWT_HIDE_REFRESH_TOKEN_FIELD": False,
     "JWT_COOKIE_NAME": "JWT",
     "JWT_REFRESH_TOKEN_COOKIE_NAME": "JWT-refresh-token",
     "JWT_COOKIE_SECURE": False,