spring oauth2 如何每次获取新的刷新令牌

Question

When I call refresh token the web service returns a new access token and the old refresh token because the access token has not yet expired. Is there any configuration that when I call refresh token this web service return me a new access token and a new refresh token?

Answer 1

Spring can be configured not to reuse refresh tokens - by default it reuses -, this should solve the issue.

@Configuration
public class OAuth2Config extends AuthorizationServerConfigurerAdapter {
    @Override
    public void configure(AuthorizationServerEndpointsConfigurer configurer) throws Exception {
        configurer.reuseRefreshTokens(false);
    }
}

Answer 2

在生成新令牌之前，您可以使用 AOP 通过删除旧令牌或更改其有效时间来使令牌无效，但如果这样做，则将使其他客户端使用的所有刷新令牌无效。