A refresh token lets a client ask an authorization server for a new access token when the current one expires. It is not the token sent to the API: requests to a protected endpoint use the access token as a Bearer token. section 8.3
In the Taco Cloud admin application, the authorization server registers a client with both authorization-code and refresh-token grants. The authorization-code exchange returns an access_token and a refresh_token; the example access token expires after about five minutes. section 8.2 section 8.3
@Bean
public RegisteredClientRepository registeredClientRepository(
PasswordEncoder passwordEncoder) {
RegisteredClient registeredClient =
RegisteredClient.withId(UUID.randomUUID().toString())
.clientId("taco-admin-client")
.clientSecret(passwordEncoder.encode("secret"))
.clientAuthenticationMethod(
ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
.redirectUri(
"http://127.0.0.1:9090/login/oauth2/code/taco-admin-client")
.scope("writeIngredients")
.scope("deleteIngredients")
.scope(OidcScopes.OPENID)
.clientSettings(
clientSettings -> clientSettings.requireUserConsent(true))
.build();
return new InMemoryRegisteredClientRepository(registeredClient);
}
The registered client enables AuthorizationGrantType.REFRESH_TOKEN alongside AUTHORIZATION_CODE. Its client ID and encoded secret identify the client when it later requests a token. section 8.2
Renew access after expiry
Suppose an admin creates an ingredient through the protected API. Once the access token expires, further requests return HTTP 401. The client sends its refresh token to the authorization server’s /oauth2/token endpoint, receives a new access token, and uses that token for subsequent API requests. section 8.3
$ curl localhost:9000/oauth2/token \
-H"Content-type: application/x-www-form-urlencoded" \
-d"grant_type=refresh_token&refresh_token=$refreshToken" \
-u taco-admin-client:secret
This curl request sets grant_type=refresh_token, supplies the previously received refresh token, and authenticates as the registered client. Substitute the actual token for $refreshToken. section 8.3
