OAuth2RestTemplate 過期後不刷新令牌 (OAuth2RestTemplate doesnt refresh the token after it expired)


問題描述

OAuth2RestTemplate 過期後不刷新令牌 (OAuth2RestTemplate doesnt refresh the token after it expired)

我正在使用 Spring OAuth2RestTemplate,並且令牌在過期後不會刷新。下面是我的令牌提供者。我錯過了什麼?任何指針都會有幫助。

@Bean
        public AccessTokenProvider clientAccessTokenProvider() {
            ClientCredentialsAccessTokenProvider accessTokenProvider = new ClientCredentialsAccessTokenProvider();
            accessTokenProvider.setRequestFactory(getClientHttpRequestFactory());
            return accessTokenProvider;
        }

參考解法

方法 1:

ClientCredentialsAccessTokenProvider doesn't not support "Refresh Token" according to spring boot oAuth implementation.

I fixed the problem by checking the expiry and setting the token in oAuthContext to null before making the rest call.

  private void checkTokenExpiry() {
        OAuth2ClientContext oAuth2ClientContext = oAuth2RestOperations.getOAuth2ClientContext();
        if (oAuth2ClientContext == null) {
            return;
        }
        OAuth2AccessToken accessToken = oAuth2ClientContext.getAccessToken();
        if (accessToken != null && (accessToken.getExpiresIn() > 5000 || accessToken
            .isExpired())) { //5 seconds
            log.info("Token expired");
            oAuth2RestOperations.getOAuth2ClientContext()
                .setAccessToken(null); //to re‑fetch the token
        }
    }

(by MinishaMinisha)

參考文件

  1. OAuth2RestTemplate doesnt refresh the token after it expired (CC BY‑SA 2.5/3.0/4.0)

#oauth-2.0 #spring-boot






相關問題

OAuth2 用戶映射和丟失我的 Cookie (OAuth2 User Mapping and Loosing my Cookies)

如何在打開 Facebook 登錄對話框之前告訴 iPhone 應用用戶會發生什麼 (How to tell an iphone app user what will happen before opening Facebook login dialogue)

帶有 spring-security 的 OAuth2 - 通過 HTTP 方法限制 REST 訪問 (OAuth2 with spring-security - limit REST access by HTTP method)

帶有Phonegap 2.3.0的Facebook oAuth沒有在成功url返回令牌作為url參數 (Facebook oAuth with Phonegap 2.3.0 not returning token as url param at success url)

Dwolla API Key、Client_id 和 Client_Secret 有什麼區別? (What is the different between Dwolla API Key, Client_id & Client_Secret?)

Linkedin 應用程序具有 OAuth 用戶令牌和 OAuth 用戶密鑰,它們會過期嗎? (Linkedin Application has OAuth User Token and OAuth User Secret, Do they Expire?)

OAuth2:保護非用戶資源 (OAuth2: Protecting non-user resources)

IOS的foursquare oauth2 (foursquare oauth2 for IOS)

Spring Boot 2 Oauth 如何實現隱式代碼流 (Spring Boot 2 Oauth how to implement Implicit Code Flow)

FusionAuth - 基於邀請的用戶登錄與社交登錄 (FusionAuth - Invite based user on-boarding with social logins)

為什麼每次發送請求時都刷新訪問令牌是個壞主意? (Why is it a bad idea to refresh access token every time when I sent request?)

如何配置必須使用“密碼”授權類型從授權服務器請求令牌的客戶端 Java 應用程序? (How do I configure a client Java application which must request a token from an authorization server using a 'password' grant type?)







留言討論