Setup for access token in header and refresh token in cookie

[arthurpeter]

How would you have to configure the AuthX and the login, logout and refresh methods so that you can use access token in the header and the refresh token in a cookie?

[yezz123]

Hello @arthurpeter here is how to configure AuthX for access token in the header and refresh token in the cookie:

The key is to use the locations parameter when retrieving tokens to override the default location per-endpoint.

Configuration:

config = AuthXConfig(
    JWT_SECRET_KEY="your-secret-key",
    JWT_TOKEN_LOCATION=["headers", "cookies"],  # Enable both
    JWT_COOKIE_CSRF_PROTECT=True,
    JWT_COOKIE_HTTP_ONLY=True,
)

Login - Set refresh in cookie, return access in body:

@app.post("/login")
def login(user: User, response: Response):
    access_token = auth.create_access_token(uid=user.username)
    refresh_token = auth.create_refresh_token(uid=user.username)
    auth.set_refresh_cookies(refresh_token, response)  # Cookie only
    return {"access_token": access_token}  # Body only

Protected routes - Read access from headers only:

@app.get("/protected")
async def protected(request: Request):
    token = await auth.get_access_token_from_request(request, locations=["headers"])
    payload = auth.verify_token(token, verify_csrf=False)
    return {"user": payload.sub}

Refresh - Read refresh from cookies only:

@app.post("/refresh")
async def refresh(request: Request):
    token = await auth.get_refresh_token_from_request(request, locations=["cookies"])
    payload = auth.verify_token(token)
    return {"access_token": auth.create_access_token(uid=payload.sub)}

Logout:

@app.post("/logout")
def logout(response: Response):
    auth.unset_refresh_cookies(response)
    return {"message": "Logged out"}

See the full example: examples/examples/dual_token_location.py

Documentation: Dual Location Pattern