spring-security icon indicating copy to clipboard operation
spring-security copied to clipboard

Check is refresh token expired in PasswordOAuth2AuthorizedClientProvider

Open adnanalicic opened this issue 1 year ago • 0 comments

When using the following configuration:

OAuth2AuthorizedClientProvider authorizedClientProvider = OAuth2AuthorizedClientProviderBuilder.builder() .password() .refreshToken() .build();

in case a refresh token is expired, the call to some endpoint will result with a 401. After that the refresh grant will be removed and than on next call the password grant will be used.

If you include a validity check of the refresh token in PasswordOAuth2AuthorizedClientProvider at line 100,101, hence to check is the refresh token valid and not just ist it present, than this would automatically use the password grant and we will get new access and refresh token without a need to make a new call after 401.

adnanalicic avatar Feb 13 '24 22:02 adnanalicic