spring-security
spring-security copied to clipboard
Check is refresh token expired in PasswordOAuth2AuthorizedClientProvider
When using the following configuration:
OAuth2AuthorizedClientProvider authorizedClientProvider = OAuth2AuthorizedClientProviderBuilder.builder() .password() .refreshToken() .build();
in case a refresh token is expired, the call to some endpoint will result with a 401. After that the refresh grant will be removed and than on next call the password grant will be used.
If you include a validity check of the refresh token in PasswordOAuth2AuthorizedClientProvider at line 100,101, hence to check is the refresh token valid and not just ist it present, than this would automatically use the password grant and we will get new access and refresh token without a need to make a new call after 401.