使用 jwt_required 保护端点
在每次 API 调用时验证令牌
使用 jwt_required 保护端点 是 CoddyKit 上的免费 Flask Academy 课时。 这是第 3 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 Flask Academy 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Flask Academy 课程共包含 4 节课。
本课时的部分内容尚未翻译，以英文显示。
Guarding a Route
A token is only useful if some routes demand it. The jwt_required decorator turns any view into a members-only endpoint. 🔒
Apply the Decorator
Stack @jwt_required() under your route. Now the view only runs when a valid, unexpired token arrives.
@app.get("/profile")
@jwt_required()
def profile():
...Where the Token Goes
Clients send the token in the Authorization header using the Bearer scheme. Flask-JWT-Extended reads it from there automatically.
Authorization: Bearer <your-token>Automatic Rejection
No token, or a bad one? The decorator stops the request before your code runs and returns a 401. You write zero checking logic.
Who Is Calling
Inside a guarded view, call get_jwt_identity to read the identity you signed at login, usually the user id.
from flask_jwt_extended import get_jwt_identity
uid = get_jwt_identity()Read the Full Claims
Need extra claims like a role? get_jwt returns the whole payload as a dict so you can branch on what is inside.
from flask_jwt_extended import get_jwt
role = get_jwt().get("role")Use the Identity
With the user id in hand, load that user and serve their data. The token told you who, so the rest is normal Flask. 🙂
user = User.query.get(get_jwt_identity())Optional Protection
Want a page that adapts whether or not someone is logged in? Use optional=True so the view runs either way.
@jwt_required(optional=True)Customize the Error
Register an unauthorized_loader to return a friendly JSON message instead of the default when a token is missing.
@jwt.unauthorized_loader
def missing(reason):
return {"msg": reason}, 401Expired Tokens
An expired token is also rejected by the decorator. The client must log in again or refresh to keep going, which keeps stolen tokens short-lived.
Never Trust the Body
Read the caller from the token, never from a user id in the request body. The signature is what makes the identity trustworthy.
Quick Check
Recall how a guarded view learns who is calling.
Recap
Add @jwt_required() to guard a route, send the token as a Bearer header, and read the caller with get_jwt_identity. 🔐
常见问题解答
「使用 jwt_required 保护端点」课时是免费的吗？
是的 — 「使用 jwt_required 保护端点」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Flask Academy 课程的其余内容，请升级到 CoddyKit PRO。 Flask Academy 课程共包含 4 节课。
「使用 jwt_required 保护端点」这节课中我会学到什么？
在每次 API 调用时验证令牌 你通过在浏览器中直接运行的动手代码来练习 Flask Academy，全天候 AI 导师会在你学习这节课的过程中回答你的问题。
学习 Flask Academy 需要有经验吗？
无需任何先前经验。CoddyKit 上的 Flask Academy 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 3 节课，共 4 节。
「使用 jwt_required 保护端点」课时需要多长时间？
大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。
我能在这节 Flask Academy 课中编写并运行代码吗？
能。每节 Flask Academy 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。