Get the token bearer with the JWT module after log in rest method

An updated version of the #29 patch is attached. It should be compatible with both Drupal 9 & 10.

Considering questions of #26, it requires some changes. And, it would be nice to have tests for the feature it adds. Unfortunately, I don't have time for it at the moment.

It would be great if this functionality was rolled into the JWT module. I've got a client site using https://www.drupal.org/project/getjwtonlogin → for this functionality but it definitely feels as though it belongs in the JWT module. I'm going to add tests and try to implement #26.

I will also add test coverage.

There's one more thing that this issue opens up. There are questions about session. If you use user.login.http a session will be generated when you log in. However if you only use the bearer token you've been given for authentication then the session will not be maintained as sessions in Drupal work via cookies. A cookie will be returned on the login request but you'll need to extract it and use it in your app which feels like a duplication of the work being done for the bearer token.

Therefore I think we should do two things:
1. Make the creation of session configurable
2. Make it possible to use the bearer token for session.

Given that these are existing issues I propose that we address this on follow-up. That said, I do have some concerns that making the creation of session configurable will necessitate significant changes to the approach of decorating the user.login.http using the response event.

I've pushed a MR that:

• Does what @pwolanin asks for in #26 - rolls the functionality into the jwt_auth_issuer module
• Adds test coverage
• Adds an update path for the new config object

Updating the issue summary to outline the more recent solution.

I've addressed @pwolanin's feedback and also opened a core issue to make this easier - see ✨ Allow modules to alter the user.login.http response data without having to re-serialize the data Active

I tested this with a SimplyTest.me site and Postman. I was able to POST to user/login?_format=json and see access_token in the response, and I was able to use that as a Bearer token to GET restricted content for /jsonapi/node/recipe.

HI @myavorsky,

How did you resolve this issue? Could you please explain in detail?

Thanks,
Ritu Raj

Automatically closed - issue fixed for 2 weeks with no activity.