CODEWITHSUNDEEP
springoauth-2.0jwtspring-security-oauth2
Shamim
Shamim

Reputation: 21

Using JWT along with refresh tokens in Spring OAuth2

Consider we want to use JWT along with refresh tokens in Spring. We have to use JWTTokenStore, right?

But if JWTTokenStore isn't a real database and doesn't store anything, where and how should we store refresh tokens?

(We prefer to store refresh tokens in database rather than store them in memory)

Upvotes: 2

Views: 1376

Answers (2)

Zig
Zig

Reputation: 1

I faced the same problem. The explanation for me is that the tokens was set in the cookies.(No sessions on client side). And I don't want that my refresh token be used like an access token. (Modifying the access token cookie with the value of the refresh token)

Upvotes: 0

Dave Syer
Dave Syer

Reputation: 58124

Refresh tokens are JWTs by default if the access tokens are. To change that you would have to modify the token services (possibly a custom TokenEnhancer would do it, and maybe also a custom TokenStore). Why not go with the default?

Upvotes: 1

Related Questions