@@ -18,6 +18,19 @@ The available options are:
18
18
the JWT in via headers. Defaults to ``'Authorization' ``
19
19
``JWT_HEADER_TYPE `` What type of header the JWT is in. Defaults to ``'Bearer' ``. This can be
20
20
an empty string, in which case the header only contains the JWT
21
+ ``JWT_COOKIE_SECURE `` If the secure flag should be set on your JWT cookies. This will only allow
22
+ the cookies to be sent over https. Defaults to ``False ``, but in production
23
+ this should likely be set to ``True ``.
24
+ ``JWT_ACCESS_COOKIE_NAME `` What the cookie that hold the access JWT will be called. Only used
25
+ when sending the JWT in via cookies. Defaults to ``access_token_cookie ``
26
+ ``JWT_REFRESH_COOKIE_NAME `` What the cookie that hold the access JWT will be called. Only used
27
+ when sending the JWT in via cookies. Defaults to ``refresh_token_cookie ``
28
+ ``JWT_ACCESS_COOKIE_PATH `` What ``path `` should be set for the access cookie. Defaults to ``None ``, which
29
+ will cause this access tookie to be sent in with every request. Should be modified
30
+ for only the paths that need the access cookie
31
+ ``JWT_REFRESH_COOKIE_PATH `` What ``path `` should be set for the refresh cookie. Defaults to ``None ``, which
32
+ will cause this access tookie to be sent in with every request. Should be modified
33
+ for only the paths that need the refresh cookie
21
34
``JWT_COOKIE_CSRF_PROTECT `` Enable/disable CSRF protection. Only used when sending the JWT in via cookies
22
35
``JWT_ACCESS_CSRF_COOKIE_NAME `` Name of the CSRF access cookie. Defaults to ``'csrf_access_token' ``. Only used
23
36
if using cookies with CSRF protection enabled
@@ -33,7 +46,7 @@ The available options are:
33
46
<https://pyjwt.readthedocs.io/en/latest/algorithms.html> `_ for the options. Defaults
34
47
to ``'HS256' ``. Note that Asymmetric (Public-key) Algorithms are not currently supported.
35
48
``JWT_BLACKLIST_ENABLED `` Enable/disable token blackliting and revoking. Defaults to ``False ``
36
- ``JWT_BLACKLIST_STORE `` Where to save created and revoked tokens. `See here
49
+ ``JWT_BLACKLIST_STORE `` Where to save created and revoked tokens. `See here
37
50
<http://pythonhosted.org/simplekv/> `_ for options.
38
51
``JWT_BLACKLIST_CHECKS `` What token types to check against the blacklist. Options are
39
52
``'refresh' `` or ``'all' ``. Defaults to ``'refresh' ``
0 commit comments