I currently built a single page React app, with a Flask back-end, but I’m having issues figuring out how to use the refresh token. When a user is authenticated through sign in I store the:

1. access token as a variable
2. refresh token in HTTP only cookie

Now when the access token expires, I POST my /refresh route that’s built like this:

@auth.route("/refresh", methods=["POST"])
@jwt_required(refresh=True, locations=["cookies"])
def refresh():
    identity = get_jwt_identity()
    access_token = create_access_token(identity=identity)
    return jsonify(access_token=access_token)

but I get this error:

{
    "code": 401,
    "message": "Missing Authorization Header"
}

I noticed in the official docs for Flask-JWT-Extended they put the refresh_token as an Authorization header, but in my case since the cookie is HTTP only, I can’t access it from the react side. I also added the locations=["cookies"], which should make Flask look for the refresh_token in cookies automatically, but that still produces the same error above.