JWT authentication always returns access?

[mdodell]

Why does JWT authentication always return access tokens to Rodauth routes? Is there a way to limit which routes it returns a JWT from?

For example, when I call forgot-password-request with an email when using JWT auth, it returns an access token for the email I am requesting a password reset email for, which I can then use in subsequent requests as an Authorization header.

[janko]

I'm assuming Jeremy designed it that way for consistency, so that you can read JWT tokens even if the data is empty (= user is not logged in). For the reset-password-request route specifically, it's possible to turn on autologin, in which case the JWT token should be returned. Is this causing a problem in your application?

I believe you could skip it by overriding set_jwt_token(token) with something like:

set_jwt_token do |token|
  next if request.path == reset_password_request_path
  super(token)
end

[mdodell]

Isn't the access token providing credentials for a user to make authorized requests in my application? Why would it return a JWT if the user is not logged in?

If I'm understanding it right, the reset-password-request path sends an email with a key in the path, which can be used to reset the password using the reset-password path.

[janko]

Isn't the access token providing credentials for a user to make authorized requests in my application? Why would it return a JWT if the user is not logged in?

Again, I cannot speak for Jeremy's design decisions, but maybe it's there to differentiate the response that logs the user out (returns token with empty data) and the one that keeps the user logged in but doesn't update any data (returns no token)? There are other scenarios that can log the user out besides /logout route, such as session expiration, so this way the client doesn't have to guess.

If I'm understanding it right, the reset-password-request path sends an email with a key in the path, which can be used to reset the password using the reset-password path.

That's correct 👍🏻