Disable jwt_required for OPTIONS requests

I notice that if a try to protect an entire blueprint with @jwt_required, than also the OPTIONS method is protected.

OPTIONS method should not include crendetials, see here.

The @jwt_required decorator should ignore OPTIONS like in flask_login:

    @wraps(func)
    def decorated_view(*args, **kwargs):
        if request.method in EXEMPT_METHODS:
            return func(*args, **kwargs)
        elif current_app.login_manager._login_disabled:
            return func(*args, **kwargs)
        elif not current_user.is_authenticated:
            return current_app.login_manager.unauthorized()
        return func(*args, **kwargs)
    return decorated_view

where EXEMPT_METHODS=set(["OPTIONS"])!

I could fix this and create a pull request if this is not a desired choice!

[ludusrusso]

@mgd722 to be honest, I don’t remember why I wrote it… I think I meant that it’s not very clean and maybe it should be more pythonic to explicit it by decorating every route that needs to be protected… What I don’t like too much is to have a “do nothing function” and decorate it…

Anyway, I like that practice and I’ll continue to use it!!

[vimalloc]

Perfect, thanks for all of the information. It sounds like excluding OPTIONS from the jwt_required functions would be the correct thing to do. If you want to submit a pull request I would be happy to get that merged, or I could work on getting that fixed up sometime next week.

Cheers 👍