Should I explicitly send the Refresh Token to get a new Access Token – JWT

by

Yes, the refresh token is used to obtain a new access token.

When you request the access token for the first time, you usually start by sending a token request to the token endpoint, in case of the so called Resource Owner Password Credentials Grant with user credentials in the request header, e.g.

grant_type=password&username=user1&passowrd=very_secret

when the access token is expired, you have to request a new access token. This time, with a refresh token which is still valid, you don’t need the user credentials again but send

grant_type=refresh_token&refresh_token=<your refresh token>

instead.
This way you don’t need to store the user credential on client side and don’t need to bother the user again with a login procedure.
As you know the expiry time, you can also implement a mechanism to refresh your token before the access_token is expired.

Additionally you can read this for further information about the topic: https://auth0.com/learn/refresh-tokens/

In the following tutorial is also a screenshot of how to use refresh token in postman: http://bitoftech.net/2014/07/16/enable-oauth-refresh-tokens-angularjs-app-using-asp-net-web-api-2-owin/ (scroll down to step 6)
Generally I can recommend reading Taiseer Joudeh’s tutorial, esp. for C#, ASP.NET uand Angular programmers.

More Related Contents:

  1. Springboot Security hasRole not working
  2. Spring Security: Upgrading the deprecated WebSecurityConfigurerAdapter in Spring Boot 2.7.0
  3. Spring Boot 2.0.0 + OAuth2
  4. Spring Security with SOAP web service is working in Tomcat, but not in WebLogic
  5. Spring Boot 2.0 disable default security
  6. I can’t update my webapp to Spring Boot 2.6.0 (2.5.7 works but 2.6.0 doesn’t)
  7. Serving static web resources in Spring Boot & Spring Security application
  8. Spring Security Configuration – HttpSecurity vs WebSecurity
  9. Spring Boot Security CORS
  10. Disable Logback in SpringBoot
  11. Jersey returns 404 with any error status code?
  12. What is the purpose of a “Refresh Token”?
  13. Spring Boot CORS filter – CORS preflight channel did not succeed
  14. Gradle 5 JUnit BOM and Spring Boot Incorrect Versions
  15. Spring boot – configure EntityManager
  16. Entity Class name is transformed into SQL table name with underscores
  17. Error resolving template “index”, template might not exist or might not be accessible by any of the configured Template Resolvers
  18. Securing Spring Boot API with API key and secret
  19. Spring Security: mapping OAuth2 claims with roles to secure Resource Server endpoints
  20. Stop consume message for Stream listener
  21. How to convert a Spring-Boot web service into a Docker image?
  22. Spring Security HTTP Basic for RESTFul and FormLogin (Cookies) for web – Annotations
  23. Define an in-memory JobRepository
  24. How do I disable resolving login parameters passed as url parameters / from the url
  25. about spring boot how to disable web environment correctly
  26. Spring Boot : Custom Validation in Request Params
  27. How do I add method based security to a Spring Boot project?
  28. Azure AD Custom Claims in JWT
  29. Certificate for doesn’t match any of the subject alternative names
  30. How to run Swagger 3 on Spring Boot 3

Leave a Comment