Verify Serializer Should Honour Blacklist

rest_framework_simplejwt/serializers.py

@@ -1,11 +1,16 @@
+from django.conf import settings
 from django.contrib.auth import authenticate
 from django.utils.translation import gettext_lazy as _
 from rest_framework import exceptions, serializers
+from rest_framework.exceptions import ValidationError
 
+from .exceptions import TokenError
 from .settings import api_settings
 from .state import User
 from .tokens import RefreshToken, SlidingToken, UntypedToken
 
+if 'rest_framework_simplejwt.token_blacklist' in settings.INSTALLED_APPS:
+    from .token_blacklist.models import BlacklistedToken
 
 class PasswordField(serializers.CharField):
     def __init__(self, *args, **kwargs):
@@ -141,4 +146,15 @@ class TokenVerifySerializer(serializers.Serializer):
     def validate(self, attrs):
         UntypedToken(attrs['token'])
 
+        if 'rest_framework_simplejwt.token_blacklist' in settings.INSTALLED_APPS:
+            try:
+                token = RefreshToken(attrs['token'])
+            # not a refresh token
+            except TokenError:
+                return {}
+
+            jti = token.get(api_settings.JTI_CLAIM)
+            if BlacklistedToken.objects.filter(token__jti=jti).exists():
+                raise ValidationError(_('Token is blacklisted'))
+
         return {}

tests/test_token_blacklist.py

@@ -5,6 +5,7 @@
 from django.test import TestCase
 
 from rest_framework_simplejwt.exceptions import TokenError
+from rest_framework_simplejwt.serializers import TokenVerifySerializer
 from rest_framework_simplejwt.settings import api_settings
 from rest_framework_simplejwt.token_blacklist.models import (
     BlacklistedToken, OutstandingToken,
@@ -190,3 +191,13 @@ def test_jti_field_should_contain_uuid_hex_strings(self):
         actual_hexes = [i.jti_hex for i in OutstandingToken.objects.all()]
 
         self.assertEqual(actual_hexes, self.expected_hexes)
+
+
+class TokenVerifySerializerShouldHonourBlacklist(TestCase):
+
+    def token_verify_serializer_shouldHonour_blacklist(self):
+        refresh_token = RefreshToken()
+        refresh_token.blacklist()
+
+        serializer = TokenVerifySerializer({"token": refresh_token.payload})
+        self.assertFalse(serializer.is_valid())