What's Changed

• Add controls for verify_sub option in PyJWT by @jlucier in #562

New Contributors

• @jlucier made their first contribution in #562

Full Changelog: 4.7.0...4.7.1

What's Changed

• Drop support for python 3.7 and 3.8, add 3.13 by @vimalloc in #559
• Fix documentation around identity needing to be a string by @vimalloc in #558

Full Changelog: 4.6.0...4.7.0

What's Changed

• Bump cryptography from 41.0.4 to 41.0.6 by @dependabot in #535
• Do not check JWT_TOKEN_LOCATION when testing if cookie_csrf_protect is enabled by @vimalloc in #538

Full Changelog: 4.5.3...4.6.0

What's Changed

• Typos by @dwinton-go in #514
• Replace "defining" with "define" by @lewisemm in #517
• Fix documentation syntax error by @dtalkachou in #519
• remove duplicate comments by @Abyssknight in #522
• Support python 3.12 and add support for flask 3.0 by @vimalloc in #527

New Contributors

• @dwinton-go made their first contribution in #514
• @lewisemm made their first contribution in #517
• @dtalkachou made their first contribution in #519
• @Abyssknight made their first contribution in #522

Full Changelog: 4.5.2...4.5.3

• Fix documentation for stable build. No code changes were made in this release.

No changes from the 4.5.0 tag, I just forgot to update the __version__ which causes issues with publishing the release. This corrects that issue and bumps the version to 4.5.1.

• Fix compatibility with flask version 2.3 (#493). Huge shout out to @jrast for taking on the bulk of this work!

Full Changelog: https://github.com/vimalloc/flask-jwt-extended/compare/4.4.3...4.4.4

• Documentation improvements ( #470). Thanks @Udit107710!
• Drop support for python 3.6 (flask no longer supports 3.6, so following suite here)
• Add option to include current_user in jinja templates by default (#478)
• Fix mypy type checks for current_user (#488)

Full Changelog: https://github.com/vimalloc/flask-jwt-extended/compare/4.4.2...4.4.3

What's Changed

• Fix mypy explicitly mark exported names #484 (thanks @KSmanis)
• Fix verify_type being set to False by default in verify_jwt_in_request() #483

Full Changelog: https://github.com/vimalloc/flask-jwt-extended/compare/4.4.1...4.4.2

What's Changed

• Documentation improvements (thanks @udoyen)
• Fix PEP 561 compatibility #480 (thanks @KSmanis)

Full Changelog: https://github.com/vimalloc/flask-jwt-extended/compare/4.4.0...4.4.1

Overview

• Drop support for Flask 1
  • This decision comes because flask 1 is no longer being supported upstream and a recent dependency change they released made it difficult to continue testing both versions for compatibility.
• Add verify_type argument to view decorators to allow accepting both refresh & access tokens #460 (thanks @tgross35)
• Adds type hinting and MyPy support
• Documentation improvements (thanks @wjjmjh and @Udit107710)
• Relax dependency pinning for cryptography package (#467)

• Allow Flask-JWT-Extended to work with new Cryptography versioning scheme (#452)

• Allow overriding cookies domain at runtime (#446). Thanks @bejito!
• Better compatibility with flask 1.x.x and 2.x.x (#440). Thanks @StefanVDWeide
• Documentation updates (#443, #444). Thanks @killthekitten and @juur

• Fix compatibility with Flask 1.x.x that was broke with the 4.2.2 release (see #437). Thanks @j178 for pointing this out!

• Added async support to jwt_required view decorator (#436). Thanks @StefanVDWeide!
• Minor documentation improvements. Thanks @rohitsanj-jovian!

• Update Flask-JWT-Extended to work with flask 2.x.x. (#427).

• Add JWT_ENCODE_NBF configuration option to allow disabling the NBF claim during token creation. Thanks @magnunleno! #416
• Add a new get_jwt_request_location() function to determine where a token was parsed from in a request (useful for implicit token refresh with cookies). Thanks @sammck! #420
• Fix wrong error message in edge case with current user in non-decorated route. #408
• Fix JWT in headers followed by a comma raises IndexError #347
• Fix edge cases where @jwt_required(optional=True) was treating a request as if there was jwt present instead of handling the InvalidHeaderError. #421
• Add a JWT_QUERY_STRING_VALUE_PREFIX configuration option. #421
• Update error messages to provide more helpful information to callers when they are sending in a token in an unexpected way.

• Allow JWT type to be things besides refresh or access (#401). Any type that is not refresh will be considered an access token. Thanks @sambonner for the PR!
• Allow locations kwarg for jwt_required() to be a string (#394)
• Minor documentation improvements

• Properly include requirements.txt in the manifest.

This release contains many months of work and lots of breaking changes. For full details, please see: https://flask-jwt-extended.readthedocs.io/en/stable/v4_upgrade_guide/

• The only change it this release is that we are setting the metadata that marks this as the last release to support python versions earlier then 3.6 (including python 2).

• Add JWT_ENCODE_ISSUER option
• Require PyJWT before version 2.0.0a to prevent breaking changes. (we will update to the 2.0.0 pyjwt release once it's out of the alpha/early release).

• Fixes a bug where missing JWTs were not being handled gracefully, introduced in version 3.23.0 (#282)

• Adds the ability to add custom data to the JWT headers via the headers kwarg when making new tokens or via the jwt_manager.additional_headers_loader decorator. These headers can be accessed in your endpoints via the get_raw_jwt_header function. Thanks @iamajay for this feature! (#271)

• Make header reading compliant with RFC7230, section 3.2.2 (#270). Thanks @Croug!

• Adds ability to check CSRF double submit token from form data instead of headers (#269). Thanks @colevscode!

• Require flask 1.0 or greater (#263)
• Move docs to pallets-sphinx-themes (#261)
• Add a new JWT_DECODE_ISSUER option for use with other JWT providers (#259)
• Gracefully handle errors for malformed tokens (#246)

• Look for JWTs in the same order that they are defined in JWT_TOKEN_LOCATION. Thanks @stephendwolff!(#256)

• Adds support for using multiple algorithms for decoding JWTs. Thanks @Darkheir! (#254)

• Fix JWT_SESSION_COOKIE = False creating a cookie that was too long in the future for some browsers (#243). Thanks @allen-cook!

• Fixes an issue when using decode_token on an expired token. This issue was introduced in 3.16.0. (#234)
• Require PyJWT 1.6.4 or newer (#238)

• Add the ability to dynamically set user claims via the new user_claims argument to create_access_token and create_refresh_token functions (#229). Thanks @jeanphix
• Add ability to use other datetime libraries for the token expiration configuration options. Anything that works with datetime.datetime (such as dateutil) will now work with extension (#233). Thanks @abathur

• Add the ability to use an integer (seconds) for the JWT_ACCESS_TOKEN_EXPIRES and JWT_REFRESH_TOKEN_EXPIRES settings. (#226) Thanks @evangilo!

This release changes how the @jwt.expired_token_loader callback function works. Before this release the callback function took no arguments. Now it will take one argument which is the decoded contents of the expired token. This lets you customize the expired token callback based on the token that was received. For example:

# Old way
@jwt.expired_token_loader
def old_expired_callback():
    return jsonify(foo='bar'), 401

# New way
@jwt.expired_token_loader
def new_expired_callback(expired_token):
    if expired_token['type'] == 'access':
        return jsonify(foo='bar'), 401
    else:
        return jsonify(foo='baz'), 401

The old way will still work, updating to this version will not break your software out from under you. You will however receive a deprecation warning when using that way. To fix this, simply add an addition argument to your callback function for the expired token.

• Adds the JWT_DECODE_LEEWAY option (#218). Thanks @otetard!
• Adds the ability to use other data structures besides lists (such as sets, tuples, etc) as config values (#215) Thanks @illia-v!

In this release we are modifying how decoded tokens work, so that this extension can be more easily used by other JWT providers (#212). The important changes in this release are:

• added the JWT_DECODE_AUDIENCE configuration option, for using the aud claim in JWTs
• Change the decode_key_callback() function to now take the unverified headers as well as the unverified claims as arguments. If you have existing code that only takes one argument, it will still work, but you will see a depreciation warning when it is called. You should update your callback to take a second parameter to fix that. As an example decode_key(claims) would become decode_key(claims, headers).
• If the jti claim doesn't exist in a token, it will now be set to None in the decoded dictionary instead of raising an error
• If the type claim doesn't exist in a token, it will be marked as an access token and 'type': 'access' will be set in the decoded dictionary
• If the fresh claim doesn't exist in a token, it will be marked as a non-fresh token and 'fresh': False will be set in the decoded dictionary

Many thanks to @acrossen for making this release possible!

• Include tests in MANIFEST.in (#197)

• Add support for custom encode and decode keys (#91). There are now two new callbacks that can be registered: decode_key_loader and encode_key_loader. The decode callback is passed in the unverified JWT claims, and must return a string that will be used to decode and verify the JWT. The encode callback is passed in the identity (as passed in to the create_access_token or create_refresh_token functions) and must return a string that will be used to encode a JWT. If unset, the JWT_SECRET_KEY, JWT_PUBLIC_KEY, or JWT_PRIVATE_KEY will still be used as appropriate.

• Requires cryptography >= 2.3 in response to https://nvd.nist.gov/vuln/detail/CVE-2018-10903

• Add ability to get the JWT from the JSON body of the request (#173). Thanks @luord!!

• Adds new JWT_ERROR_MESSAGE_KEY option to change the JSON key on the default error messages (#160)

• Adds new JWT_CLAIMS_IN_REFRESH_TOKEN configuration option, which if set to true will cause the user claims to be loaded into refresh tokens as well as access tokens (#100).

I forgot to actually increase the version number on the 3.9.0 release. Whoops. Nothing new from 3.9.0 minus a the version number fix.

• Allow option to unset access and refresh cookies independently of each other (#148)

• Fixes JSON encoder added in 3.8.0 (#140)

• Default to the Flask JSON encoder and allows for custom JSON encoders for encoding JWTs (#139)

• Fixes a CSRF error when using jwts in cookies and the @jwt_optional decorator (#129)

In this release, we are no longer toggling the flask PROPAGATE_EXCEPTIONS = True setting in this extension. It was set in here initially to get things working with flask-restful, but setting a global flask option in here just so that it would work with another flask extension was a poor design choice.

Note that if you are using flask-restful (or possibly other extensions) and the error handlers stop working after this update, you will need to manually set the PROPAGATE_EXCEPTIONS setting in your configuration to keep everything working. Sorry all the inconvenience.

• Removed PROPAGATE_EXCEPTIONS setting from this extension
• Internal cleanup and refactoring

• @jwt_required (et al) no longer require authorization to be present on an OPTIONS request (#119)
• Add Add Werkzeug>=0.14 to install requirements (#115)

• Adds ability to use the samesite cookie attribute (#34, #113, #115). Requires Werkzeug >= 0.14. Thanks @farshiana!

• Exports get_csrf_token to the api (#112)

• Add ability to set the fresh argument when creating access tokens to a datetime.timedelta, which will cause the token to be marked as fresh from now until the timedelta is past (#107). Thanks @dunkmann00!

• Add ability to disable expires check for JWTs (#105 and #106). Thanks @beenje!

• Fix MANIFEST.in spelling, caused LICENSE file to not be properly included in pypi (#88)

• Previous test of 3.3.2 (for adding license file) caused pypi to not allow 3.3.2 to be reused, even though that release was nuked. Just incrementing the version number once more. See the 3.3.2 release notes

• No longer returns the InvalidHeaderError handler if an authorization header appears in a different format then we expect in the @jwt_optional endpoint. (refs #82)

• Add possibility to set up cookies max-age during runtime (#81)
• Register this extension with a flask app in a more proper way (043ba2390ee82920c6297e9334fee9113df8b8b5)

• Adds optional @jwt.claims_verification_loader and @jwt.claims_verification_failed_loader to do verification of the user_claims in an access token (refs #64 #70)