Learning Objectives

• Implement OAuth2 with JWT
• Role-based access control
• Token refresh mechanism

JWT with Refresh

python
Run Inline
from flask_jwt_extended import (
    create_access_token, create_refresh_token,
    jwt_required, get_jwt_identity
)
@app.route('/login', methods=['POST'])
def login():
    user = authenticate(request.json)
    access = create_access_token(identity=user.id)
    refresh = create_refresh_token(identity=user.id)
    return {'access_token': access, 'refresh_token': refresh}
@app.route('/refresh', methods=['POST'])
@jwt_required(refresh=True)
def refresh():
    identity = get_jwt_identity()
    access = create_access_token(identity=identity)
    return {'access_token': access}

Q1: How to implement role-based access?

Add 'role' field to User model. Create decorator @requires_roles('admin', 'manager'). Check user role in JWT claims. Q2: Why use refresh tokens?

Access tokens expire quickly (15 min), refresh tokens last longer (7 days). Reduces exposure if token stolen. Only sent to /refresh endpoint. Q3: How to handle OAuth2 (Google login)?

Use Authlib or flask-oauthlib. Redirect to Google, receive code, exchange for token, get user info, create local user. Join Discord PreviousMilestone 2: Database Design & ORMNextMilestone 4: Frontend State Management with Redux