GetBlimp/django-rest-framework-jwt — pull request #23 by alvinchow86 (2014-06-19 23:56:36+00:00)
Title: Add refresh token feature

Added an optional endpoint that can refresh a token. This can be useful for a webapp to try to keep a user logged in without having to re-enter their password constantly. Got the idea from this post https://auth0.com/blog/2014/01/27/ten-things-you-should-know-about-tokens-and-cookies/

Basically, if `JWT_ALLOW_TOKEN_RENEWAL` is True, then an extra field `orig_iat` (stands for original issue at time) is stored on the returned JWT token. You can then pass the token to the `RefreshJSONWebToken` view, and if `orig_iat` hasn't yet expired, you get a token with a refreshed expiration time (but with the same `orig_iat`, so you can only do refreshes up to some time limit, specified in `JWT_TOKEN_RENEWAL_LIMIT`). Getting a brand new token (by passing in username/password) will return a completely new `orig_iat` though.

I also added a new handler, `jwt_get_user_id_from_payload`, that lets you specify how the `user_id` field is stored. Since it's possible for the custom payload handler to change how the user id is stored, it seems to make sense to have a way to retrieve it too.

Feedback welcome (there are some things that could probably be cleaned up). I didn't add tests yet but if there is interest in this PR I will write some (I did write a number of tests in my application that uses this, so I am reasonably confident it works).