我正在做一个小项目。我有一个教师的装饰器。我在登录页面上生成的JWT允许输入不同的根。我想生成一个有过期时间的JWT。但是有一个问题，我可以在Postman中看到过期时间，但是我可以在过期时间过后使用它。这是我的装饰器

def teachers():
    def wrapper(f):
        @wraps(f)
        def decorator(*args,**kwargs):
            token = request.headers["Authorization"]
            token = str.replace(str(token), 'Bearer ', '')
            try:
                data = jwt.decode(token, "testing",algorithms=["HS256"])
                print("Token is still valid and active")
            except jwt.ExpiredSignatureError:
                print("Token expired. Get new one")
            except jwt.InvalidTokenError:
                print("Invalid Token")
            if data['role'] == "teacher" or data['email'] == "admin@admin.com" :
                return f(*args,**kwargs)
            else:
                return jsonify({"message": "Authentication failed"})
        return decorator

    return wrapper

和登录页面：

@app.route('/teacherlogin', methods=['POST'])
def teacherlogin():
    email = request.form["email"]
    password = request.form["password"]
    role = request.form["role"]
    dt=datetime.now()+timedelta(seconds=120)
    try:
        user = users.find({"$and": [{"email": email}, {"role": role}]})[0]
    except IndexError:
        return jsonify({"User not found"})
    hashed_pw = user["password"]
    if bcrypt.hashpw(password.encode('utf8'), hashed_pw) == hashed_pw:
        token = jwt.encode({
            'email': email,
            'password': password,
            'role': role,
            'exp':dt
        }, app.config['SECRET_KEY'])
        res = make_response("Successful", 200)
        res.set_cookie(
            "JWT",
            value=token,
            expires=dt,
            httponly=True)
        return res
    else:
        return jsonify({"error": "Wrong password"})

我可以在Postman Cookie部分看到过期时间，但即使在此时间过后，我仍可以使用它Postman Cookie：JWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImFkbWluQGFkbWluLmNvbSIsInBhc3N3b3JkIjoiYWRtaW4iLCJyb2xlIjoiYWRtaW4iLCJleHAiOjE2NjQyMDkyNTh9.HfanKS-2J50YteuhQg5x_gKQAOd1RPY0DDB64pyCxjU; Path=/; HttpOnly; Expires=Mon, 26 Sep 2022 16:20:58 GMT;