在某些情況下，您可能希望同時(shí)為受保護(hù)和不受保護(hù)的數(shù)據(jù)使用一個(gè)endpoint.在這些情況下，可以使用jwt_optional()裝飾器。這將允許訪問(wèn)端點(diǎn)而不管JWTtoken是否隨請(qǐng)求一起發(fā)送.如果在請(qǐng)求中發(fā)送了一個(gè)已過(guò)期或構(gòu)造錯(cuò)誤的JWT，則將返回一個(gè)錯(cuò)誤，由用戶決定下一步如何進(jìn)行，而不是直接范圍response錯(cuò)誤。

from flask import Flask, jsonify, request
from flask_jwt_extended import (
    JWTManager, jwt_optional, create_access_token,
    get_jwt_identity
)

app = Flask(__name__)

# Setup the Flask-JWT-Extended extension
app.config['JWT_SECRET_KEY'] = 'super-secret'  # Change this!
jwt = JWTManager(app)


@app.route('/login', methods=['POST'])
def login():
    username = request.json.get('username', None)
    password = request.json.get('password', None)
    if not username:
        return jsonify({"msg": "Missing username parameter"}), 400
    if not password:
        return jsonify({"msg": "Missing password parameter"}), 400

    if username != 'test' or password != 'test':
        return jsonify({"msg": "Bad username or password"}), 401

    access_token = create_access_token(identity=username)
    return jsonify(access_token=access_token), 200


@app.route('/partially-protected', methods=['GET'])
@jwt_optional
def partially_protected():
    # If no JWT is sent in with the request, get_jwt_identity()
    # will return None
    current_user = get_jwt_identity()
    if current_user:
        return jsonify(logged_in_as=current_user), 200
    else:
        return jsonify(logged_in_as='anonymous user'), 200


if __name__ == '__main__':
    app.run()