Spring OAuth2 Refresh token expiration

Question

I am wondering if my refresh token validity <property name="refreshTokenValiditySeconds" value="6000" /> expires, does spring automatically removes it from DB calling TokenStore method void removeRefreshToken(OAuth2RefreshToken var1); Or it is handled differently after expiration ?

Answer 1

Spring does not expire the refresh token automatically. Your TokenStore implementation has to take care of that. For example a Redis backed token store can expire token key-value pairs autonomously if the key expiry is is set.

removeRefreshToken(..) is for explicitly removing stored refresh tokens.