[Python] Erro relacionado a remoção de Cookies HttpOnly

Estou fazendo um sistema utilizando Django (back-end) e React (front). Meu problema está relacionado ao logout do usuário, pois os Cookies não estão sendo limpos no front-end, e assim ele continua sendo passado nas requisições mesmo após o logout. Aqui estão minhas views de autenticação:

from django.http import JsonResponse
from rest_framework.decorators import api_view
from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework import status
from rest_framework_simplejwt.tokens import AccessToken
from rest_framework_simplejwt.views import TokenRefreshView
from rest_framework_simplejwt.tokens import RefreshToken
from rest_framework_simplejwt.exceptions import InvalidToken
from rest_framework_simplejwt.token_blacklist.models import BlacklistedToken
from django.contrib.auth import authenticate

class LoginView(APIView):
def post(self, request):
email = request.data.get("email")
password = request.data.get("password")

user = authenticate(email=email, password=password)
if user is None:
return Response({"detail": "Invalid credentials"}, status=status.HTTP_401_UNAUTHORIZED)

refresh = RefreshToken.for_user(user)
access_token = str(refresh.access_token)

response = Response({"detail": "Login successful"}, status=status.HTTP_200_OK)
response.set_cookie(
key="access_token",
value=access_token,
httponly=True,
secure=True,
samesite="None",
path="/"
)
response.set_cookie(
key="refresh_token",
value=str(refresh),
httponly=True,
secure=True,
samesite="None",
path="/"
)
return response

class LogoutView(APIView):
def post(self, request):
refresh_token = request.COOKIES.get("refresh_token")

if refresh_token:
try:
refresh = RefreshToken(refresh_token)
refresh.blacklist()
except Exception as e:
return Response({"error":"Error invalidating token:" + str(e) }, status=status.HTTP_400_BAD_REQUEST)

response = Response({"message": "Successfully logged out!"}, status=status.HTTP_200_OK)

try:
response.delete_cookie(
key="access_token",
path="/"
)
response.delete_cookie(
key="refresh_token",
path="/"
)
response.data = {"message": "The cookie was removed"}
except Exception as e:
response.data = {"error": f"Remove cookie error: {str(e)}"}
response.status_code = status.HTTP_400_BAD_REQUEST

return response

class CookieTokenRefreshView(TokenRefreshView):
def post(self, request):

refresh_token = request.COOKIES.get("refresh_token")

if not refresh_token:
return Response({"error":"Refresh token not provided"}, status= status.HTTP_401_UNAUTHORIZED)

try:
refresh = RefreshToken(refresh_token)
access_token = str(refresh.access_token)

response = Response({"message": "Access token token refreshed successfully"}, status=status.HTTP_200_OK)
response.set_cookie(key="access_token",
value=access_token,
httponly=True,
secure=True,
samesite="None")
return response
except InvalidToken:
return Response({"error":"Invalid token"}, status=status.HTTP_401_UNAUTHORIZED)


class CheckIsAuth(APIView):
def get(self, request):
access_token = request.COOKIES.get("access_token")

if not access_token:
return Response({"message": "Access token were not provided"}, status=status.HTTP_401_UNAUTHORIZED)

try:
access = AccessToken(access_token)

if BlacklistedToken.objects.filter(token__jti=access["jti"]).exists():
return Response({"message": "Token is blacklisted"}, status=status.HTTP_401_UNAUTHORIZED)

user = request.user

if user.is_authenticated:
return JsonResponse({"User": user.email}, status=status.HTTP_200_OK)
else:
return Response({"error": "User is not authenticated"}, status=status.HTTP_401_UNAUTHORIZED)

except InvalidToken:
return Response({"message": "Invalid token"}, status=status.HTTP_401_UNAUTHORIZED)


Já verifiquei a aba Network do navegador e pude verificar que ao fazer o logout, os tokens "access_token" e "refresh_token" permanecem nos Cookies do navegador. E qual o problema nisso? Eu uso a view "CheckIsAuth" para verificar se o usuário está autenticado, e mesmo após o logout, o servidor retorna que o usuário está autenticado.

O estranho é que se eu tento fazer outro logout, após ter feito o logout anteriormente, o servidor retorna que o token está na blacklist, e esse mesmo token no "CheckIsAuth" é válido.

Preciso de ajuda para fazer com que após o login, os Cookies sejam removidos do navegador, ou então, que o access_token seja inválido, para que a view "CheckIsAuth" retorne um 401, indicando que o usuário não está autorizado.

Continue reading...