Does not account for devise-jwt's revocation strategy about devise-jwt-cookie HOT 5 CLOSED

@scarhand it works! Glad my middleware snippet helped :)

Awesome, issue solved

from devise-jwt-cookie.

Thanks for the feedback. It's been a while since I worked on this, and don't know from the top of my head how the revocation strategies work (or should work :)).

It could be that it just unsets/removes the cookie, but does not run the revocation strategy. I'd have to dig a bit deeper to find out what happens exactly. I'll set up a test project and I'll see if I can find out what happens. Could take some time though, I'm a bit wrapped up in other things at the moment.

from devise-jwt-cookie.

@derekyau which revocation strategy are you normally using? The Allowlist, or the Denylist?

from devise-jwt-cookie.

@scarhand I'm using the Allowlist in my app. Yeah, after adding the header back in with that middleware hack it seems to work for now

Great work on this btw, I was shocked there wasn't a library for Rails that did httpOnly cookie based authentication, this was the perfect fit.

from devise-jwt-cookie.

I've made some changes that should add the header if the token should be revoked. It essentially does the same as your middleware work-around, but in the gem itself. Thanks for the hint :)

I've built and pushed a new version. Could you let me know if this solves the issue, and removes the need for the additional middleware?

from devise-jwt-cookie.