0

There is spring-security-oauth2 service with grant_type=password, refresh token.

I want to store refresh_token in java code and not send it to client via http(s). (why? - here)

So, 2 cases have to be handled:
1. do not send refresh_token in response
2. automatically insert refresh_token in request when in needed

1st can be done as in here

Question: how 2nd case can be done?

Usually, to get access token via refresh_token following request have to be sent:

POST: .../oaut/token?refresh_token=***&grant_type=refresh_token

I want to send

POST: .../oaut/token?access_token=***&grant_type=refresh_token

and then fetch refresh_token corresponding to access_token from some storage and add it as request parameter

Community
  • 1
  • 1
anastsiacrs
  • 159
  • 4
  • 18

1 Answers1

0

Simple custom Spring Filter can help here. In particular OncePerRequestFilter.class [example]

anastsiacrs
  • 159
  • 4
  • 18