Spring Security keeps a refresh token internally, and only requests a new access token when the "current" access token is expired.
However, how to explicitly request/force Spring Security to request a new access token from the Authorization Server, even though the current access token is not expired yet?
I'm in a use case where my API server invalidates the access token sent by my client on every request, to every request to the API needs a new access token generated by my client.
Comment From: godfriedmeesters
So the question is, can Spring Security on the client side create "one-time" access tokens instead of waiting for (opaque) access tokens to be expired? If I send the same access token to the API, the API will complain that I cannot use the same access token twice.
Comment From: godfriedmeesters
Can be closed, as a hack I cache the result of the token introspection so that no invalid token exception is thrown anymore.
@Cacheable("introspectionCache")
public OAuth2AuthenticatedPrincipal introspect(String token) { ...