title: Flask JWT-extended not recognizing access token, only when GET method is used
body: <p><strong>Hi everyone!</strong></p>
  <p>I'm building a website, and I'm stuck with sending a form. My problem is that it sends the <code>access_token_cookie</code>, but triggers the <code>unauthorized_token_callback</code>. I saw the request and the respone and the request contains the token, but the code pretends like it's not even there.</p>
  <p>I can't wrap my head around it, and I need some good tips.</p>
  <p>Here is the JWT configuration, the secret keys are not included in this snippet:</p>
  <pre><code>application.config['JWT_TOKEN_LOCATION'] = ['cookies', 'headers', 'json', 'query_string']
  application.config['JWT_COOKIE_SECURE'] = False #! Needs to be changed in production
  application.config['JWT_COOKIE_CSRF_PROTECT'] = True
  application.config['JWT_CSRF_CHECK_FORM'] = True
  application.config['JWT_COOKIE_SAMESITE'] = 'Strict'
  application.config['CSRF_COOKIE_NAME'] = 'csrf_token'
  application.config['JWT_ACCESS_CSRF_HEADER_NAME'] = ['X-CSRF-TOKEN-ACCESS', 'X-CSRFToken']
  application.config['JWT_CSRF_IN_COOKIES'] = True
  </code></pre>
  <p>I'm using a custom decorator, that restricts the user access based on the role of the user:</p>
  <pre><code>def Xrole_required(fn):
      @wraps(fn)
      def wrapper(*args, **kwargs):
          verify_jwt_in_request()
          role = dth.get_user_by_email(get_jwt_identity()).roles.role_name
          if(role != 'required_role'):
              flash('Xrole required', 'error')
              return Response(render_template('404.html', title='Not Logged In'), 404, mimetype='text/html')
          else:
              return fn(*args, **kwargs)
      
      return wrapper
  </code></pre>
  <p>Whenever I remove the decorator, it redirects me with no problem, but using it says that I'm not logged in. I use this decorator on other places and there it works perfectly fine.</p>
  <p>The interesting thing is, that this works on every <code>GET</code> request, but it does not, on other methods. Here is the form, so you can see it:</p>
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;form class="form-control" action="{{ url_for('MyEndpoint_name', show='active') }}" method="POST"&gt;
    &lt;div class="row pt-2"&gt;
      &lt;label for="desc" class="required"&gt;Description&lt;/label&gt;
      &lt;input id="desc" name="desc" type="text" required class="shadow-sm rounded border"&gt;
    &lt;/div&gt;
    &lt;div class="row pt-2"&gt;
      &lt;label&gt;Text&lt;/label&gt;
      &lt;input type="text" class="shadow-sm rounded border"&gt;
    &lt;/div&gt;
    &lt;div class="row pt-2"&gt;
      &lt;label&gt;Number&lt;/label&gt;
      &lt;input type='number' value="0" min="0" class="shadow-sm rounded border"&gt;
    &lt;/div&gt;
      &lt;button type="button" class="btn btn-secondary" data-bs-dismiss="modal"&gt;Cancel&lt;/button&gt;
      &lt;button type="submit" class="btn btn-primary"&gt;Submit&lt;/button&gt;
  &lt;/form&gt;</code></pre>
  </div>
  </div>
  </p>
  <p>And here is the resource that handles the request:</p>
  <pre><code>class MyResource(Resource):
      
      @Xrole_required
      def post(self, show):
          #here comes the code, this is only for test
          return redirect(url_for('/redirect_page'), 303)
  </code></pre>
  <p>Did I make a mistake in here somewhere, or did I miss some crucial part of the documentation?</p>
  <p>Please note, that I don't want to use <code>XMLHttpRequest</code>, because it would be an overkill, I have a lot of js already and these are simple forms.</p>