AttributeError: 'AppContext' object has no attribute 'expired_jwt'

[philippeboyd]

After updating from 3.15 to 3.16 or greater, an expired token will throw the following error:

Traceback (most recent call last):
  File "/Users/user/path/to/venv/lib/python3.7/site-packages/flask/app.py", line 2309, in __call__
    return self.wsgi_app(environ, start_response)
  File "/Users/user/path/to/venv/lib/python3.7/site-packages/flask/app.py", line 2295, in wsgi_app
    response = self.handle_exception(e)
  File "/Users/user/path/to/venv/lib/python3.7/site-packages/flask_cors/extension.py", line 161, in wrapped_function
    return cors_after_request(app.make_response(f(*args, **kwargs)))
  File "/Users/user/path/to/venv/lib/python3.7/site-packages/flask/app.py", line 1741, in handle_exception
    reraise(exc_type, exc_value, tb)
  File "/Users/user/path/to/venv/lib/python3.7/site-packages/flask/_compat.py", line 35, in reraise
    raise value
  File "/Users/user/path/to/venv/lib/python3.7/site-packages/flask/app.py", line 2292, in wsgi_app
    response = self.full_dispatch_request()
  File "/Users/user/path/to/venv/lib/python3.7/site-packages/flask/app.py", line 1815, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "/Users/user/path/to/venv/lib/python3.7/site-packages/flask_cors/extension.py", line 161, in wrapped_function
    return cors_after_request(app.make_response(f(*args, **kwargs)))
  File "/Users/user/path/to/venv/lib/python3.7/site-packages/flask/app.py", line 1719, in handle_user_exception
    return handler(e)
  File "/Users/user/path/to/venv/lib/python3.7/site-packages/flask_jwt_extended/jwt_manager.py", line 99, in handle_expired_error
    token = ctx_stack.top.expired_jwt
AttributeError: 'AppContext' object has no attribute 'expired_jwt'

        @app.errorhandler(ExpiredSignatureError)
        def handle_expired_error(e):
            try:
                token = ctx_stack.top.expired_jwt #<--- explodes here
                return self._expired_token_callback(token)
            except TypeError:
                msg = (
                    "jwt.expired_token_loader callback now takes the expired token "
                    "as an additional paramter. Example: expired_callback(token)"
                )
                warn(msg, DeprecationWarning)
                return self._expired_token_callback()

I do not have a custom expired_token_loader so I'm using the default one (default_expired_token_callback)

[vimalloc]

That's odd, I'm not seeing the same behavior on a fresh virtual env with flask-jwt-extended installed. I'm testing using this:

import datetime

from flask import Flask, jsonify, request
from flask_jwt_extended import (
    JWTManager, jwt_required, create_access_token
)

app = Flask(__name__)

app.config['JWT_SECRET_KEY'] = 'super-secret'  # Change this!
jwt = JWTManager(app)


@app.route('/login', methods=['POST'])
def login():
    token = create_access_token('test', expires_delta=datetime.timedelta(seconds=-120))
    ret = {'access_token': token}
    return jsonify(ret), 200


@app.route('/protected', methods=['GET'])
@jwt_required
def protected():
    return jsonify({'hello': 'world'}), 200


if __name__ == '__main__':
    app.run()

Client logs

± http POST :5000/login
HTTP/1.0 200 OK
Content-Length: 295
Content-Type: application/json
Date: Thu, 14 Mar 2019 15:26:43 GMT
Server: Werkzeug/0.14.1 Python/3.7.2

{
    "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE1NTI1NzcyMDMsIm5iZiI6MTU1MjU3NzIwMywianRpIjoiNGI1MGJjNGQtYzRlZi00ZjkxLTk5MTYtYjRjNDBiOGExYTJiIiwiZXhwIjoxNTUyNTc3MDgzLCJpZGVudGl0eSI6InRlc3QiLCJmcmVzaCI6ZmFsc2UsInR5cGUiOiJhY2Nlc3MifQ.JnQj7kkYVi1XHjL63iA0z3cjUWTM_fe61S_eIb-bu0Q"
}

± export ACCESS_TOKEN="eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE1NTI1NzcyMDMsIm5iZiI6MTU1MjU3NzIwMywianRpIjoiNGI1MGJjNGQtYzRlZi00ZjkxLTk5MTYtYjRjNDBiOGExYTJiIiwiZXhwIjoxNTUyNTc3MDgzLCJpZGVudGl0eSI6InRlc3QiLCJmcmVzaCI6ZmFsc2UsInR5cGUiOiJhY2Nlc3MifQ.JnQj7kkYVi1XHjL63iA0z3cjUWTM_fe61S_eIb-bu0Q"

± http GET :5000/protected "Authorization: Bearer $ACCESS_TOKEN"
HTTP/1.0 401 UNAUTHORIZED
Content-Length: 28
Content-Type: application/json
Date: Thu, 14 Mar 2019 15:27:33 GMT
Server: Werkzeug/0.14.1 Python/3.7.2

{
    "msg": "Token has expired"
}

Server logs

 * Serving Flask app "test" (lazy loading)
 * Environment: production
   WARNING: Do not use the development server in a production environment.
   Use a production WSGI server instead.
 * Debug mode: off
 * Running on http://127.0.0.1:5000/ (Press CTRL+C to quit)
127.0.0.1 - - [14/Mar/2019 09:26:43] "POST /login HTTP/1.1" 200 -
127.0.0.1 - - [14/Mar/2019 09:27:33] "GET /protected HTTP/1.1" 401 -

What version of python/flask/flask-jwt-extended are you seeing this with? Could you provide an example that demonstrates this behavior?

[philippeboyd]

Indeed it's very odd. I'm using the same venv and I'm not able to reproduce using a minimalistic setup... I'll try to reproduce the error by checking all my configurations and whatnot.
I'll update this issue.

[vimalloc]

Sounds good. Let me know what you find, or if I can help out at all. 👍

[danigoland]

@philippeboyd I had the same problem when switching from 3.15 to 3.16, it was caused because I had a custom _decode_jwt_from_request function.
The problem was that a part of the function changed to add the expired jwt token to the top of the context stack.
3.15 --> 3.16

My solution was to add it to the context stack in my _decode_jwt_from_request.

Hope this helps 😄

[xolott]

I have the same issue after update to latest version:
These are my callbacks;

def add_custom_claims(user):
    return user.license()


def user_identity_lookup(user):
    return user.user_id


def expired_token():
    response = jwt_errors.JwtExpired(request, get_api_version())
    response.domain = "auth"
    return response.generate()


def invalid_token(reason):
    response = jwt_errors.JwtInvalid(request, get_api_version())
    response.domain = "auth"
    response.reason = reason
    return response.generate()


def unauthorized(reason):
    response = jwt_errors.JwtRequired(request, get_api_version())
    response.domain = "auth"
    response.reason = reason
    return response.generate()


def set_jwt_callbacks():
    jwt.user_claims_loader(add_custom_claims)
    jwt.user_identity_loader(user_identity_lookup)
    jwt.expired_token_loader(expired_token)
    jwt.invalid_token_loader(invalid_token)
    jwt.unauthorized_loader(unauthorized)

[vimalloc]

This strange is so very strange. People are obviously running into this issue, but I cannot for the life of me reproduce it. Could you possibly create a minimal, complete, and verifiable example that triggers this behavior? If I could reproduce this that would go a very very long way towards actually tracking down the issue.

[xolott]

I figured out what was causing my exception, it is a call to the method decode_token on the before_request flask's hook. This is my minimal, complete, and verifiable example based on the the one from this project docs:

from flask import Flask, jsonify, request, g
from flask_jwt_extended import (
    JWTManager,
    jwt_required,
    create_access_token,
    get_jwt_identity,
    decode_token,
)

app = Flask(__name__)

# Setup the Flask-JWT-Extended extension
app.config["JWT_SECRET_KEY"] = "super-secret"  # Change this!
app.config["JWT_ACCESS_TOKEN_EXPIRES"] = 5
jwt = JWTManager(app)


@app.before_request
def _get_token():
    auth_header = request.headers.get("Authorization")
    g.token = None
    if auth_header and "Bearer" in auth_header:
        jwt_token = auth_header.split(" ")[-1]
        g.token = decode_token(jwt_token)


# Provide a method to create access tokens. The create_access_token()
# function is used to actually generate the token, and you can return
# it to the caller however you choose.
@app.route("/login", methods=["POST"])
def login():
    if not request.is_json:
        return jsonify({"msg": "Missing JSON in request"}), 400

    username = request.json.get("username", None)
    password = request.json.get("password", None)
    if not username:
        return jsonify({"msg": "Missing username parameter"}), 400
    if not password:
        return jsonify({"msg": "Missing password parameter"}), 400

    if username != "test" or password != "test":
        return jsonify({"msg": "Bad username or password"}), 401

    # Identity can be any data that is json serializable
    access_token = create_access_token(identity=username)
    return jsonify(access_token=access_token), 200


# Protect a view with jwt_required, which requires a valid access token
# in the request to access.
@app.route("/protected", methods=["GET"])
@jwt_required
def protected():
    # Access the identity of the current user with get_jwt_identity
    current_user = get_jwt_identity()
    return jsonify(logged_in_as=current_user), 200


if __name__ == "__main__":
    app.run()

After making a request to the /protected endpoint, prints:

...
site-packages/flask_jwt_extended/jwt_manager.py", line 99, in handle_expired_error
    token = ctx_stack.top.expired_jwt
AttributeError: 'AppContext' object has no attribute 'expired_jwt'

Env:

• Python 3.6.7 (virtual env with pipenv)
• Ubuntu 18.04.2

Dependencies

• flask 1.0.2
• flask-jwt-extended 3.18.0

[vimalloc]

Got it! Thank you so much for tracking that down!

The issue is that I'm setting the expired token in the app context after the decode_token call here: https://github.com/vimalloc/flask-jwt-extended/blob/master/flask_jwt_extended/view_decorators.py#L272. Now that I know what's going on this shouldn't be bad to fix at all. I think if I catch the expired token error in the decode_token function instead, save it on the context stack, and re-raise the exception, everything should be peachy.

I'm in the middle of moving so it might take me a couple days to get the fix for this released, but I'll make it a priority and get a new version out ASAP. In the mean time, you could update your before request to look something like this instead if you wanted, assuming your JWT_TOKEN_LOCATION, JWT_HEADER_NAME, and JWT_HEADER_TYPE options are correctly set (https://flask-jwt-extended.readthedocs.io/en/latest/options.html)

from flask_jwt_extended import verify_jwt_in_request

@app.before_request
def _get_token():
    verify_jwt_in_request()
    # Really this isn't needed anymore, you could just use get_raw_jwt() in place of
    # g.token, it's basically the same thing. But leaving it here for completeness sake
    # of the example
    g.token = get_raw_jwt() 

Thanks again for tracking this down!!! 👍

[vimalloc]

The fix is released in version 3.18.1.

Cheers!