0

I am working on a backend application that exposes a JSON-based REST api. However, I am using some library that has some of its own endpoints and they accept form-endcoded data. I want to extend the actions done by those endpoints and expose my extended versions. At the same time, I want my API to be consistent and I want all my endpoints to use JSON. To be more specific, I use the oauth2_provider library, and I want to logout users when they revoke a token. I am also considering making a logout handle that would require the bearer token in the Authorization header and would both logout the user and revoke the token.

My first approach to this was to write a wrapper view around the oauth2_toolkit revoke token view, loggging the user out in the wrapper view and then calling the actual revoke_token view. However, I have to modify the body of the request, which is immutable.

class Logout(View):
   def get(self, request):
       if request.user.is_authenticated:
           logout(request)
       # modify the .body attr of the request or create a new request here
       RevokeTokenView.as_view(request)

I couldn't find a way to clone a Django request or modify it. Is there a way to do it? (For now I am looking into creating a custom oauthlib_backend_class, but it feels as a bit of an overkill)

UPD: the data that is required by the revoke_token view is in the request_body

Ibolit
  • 9,218
  • 7
  • 52
  • 96

1 Answers1

2

You can modify the immutable request body like below:

class Logout(View):
   def get(self, request):
       if request.user.is_authenticated:
           logout(request)
       # modify or create a new request here
       body = request.GET.copy()
       body['key'] = 'new_value'
       request.GET = body
       RevokeTokenView.as_view(request)

UPDATE: If you want to change .body attribute of the request object, according to django's implementation, you should change the ._body attribute which is a private attribute of the request object.

nima
  • 1,645
  • 9
  • 18
  • The problem is that the params are not in GET or POST, they are in the .body . I will update my question – Ibolit Feb 06 '20 at 13:03