Refresh token pattern in Spring Boot - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a refresh token is expired in this Spring Boot code?

Consider this simplified Spring Boot controller method that handles refresh tokens. What will be the HTTP response status if the refresh token is expired?

Spring Boot

public ResponseEntity<?> refreshToken(@RequestBody TokenRefreshRequest request) {
    String requestRefreshToken = request.getRefreshToken();
    return refreshTokenService.findByToken(requestRefreshToken)
        .map(refreshTokenService::verifyExpiration)
        .map(RefreshToken::getUser)
        .map(user -> {
            String token = jwtUtils.generateTokenFromUsername(user.getUsername());
            return ResponseEntity.ok(new TokenRefreshResponse(token, requestRefreshToken));
        })
        .orElseThrow(() -> new TokenRefreshException(requestRefreshToken, "Refresh token is not in database!"));
}

A Returns HTTP 200 with a new access token

B Returns HTTP 500 Internal Server Error due to null pointer

C Returns HTTP 401 Unauthorized without a new token

D Throws TokenRefreshException leading to HTTP 403 Forbidden

💡 Hint

Look at what happens when verifyExpiration fails or token is not found.

If the refresh token is expired, verifyExpiration throws a TokenRefreshException. This exception is caught by the global exception handler which returns HTTP 403 Forbidden.

❓ state_output

intermediate

What is the value of the new access token after refresh?

Given this snippet from a refresh token service, what will be the value of the new access token returned?

Spring Boot

public String generateTokenFromUsername(String username) {
    return Jwts.builder()
        .setSubject(username)
        .setIssuedAt(new Date())
        .setExpiration(new Date(System.currentTimeMillis() + 600000))
        .signWith(SignatureAlgorithm.HS512, jwtSecret)
        .compact();
}

// Assume username = "alice" and jwtSecret = "secretKey"

A A plain string 'alice' without any token structure

B A JWT token string with subject 'alice' and expiration 10 minutes from now

C An empty string because jwtSecret is invalid

D A token string with subject 'secretKey' instead of 'alice'

💡 Hint

The method builds a JWT with the username as subject and signs it.

The method creates a JWT token with the username as the subject, sets issued and expiration times, and signs it with the secret key. The token is a compact JWT string.

📝 Syntax

advanced

Which option correctly defines a RefreshToken entity with expiration date?

Choose the correct Java entity class definition for a RefreshToken with fields: id (Long), token (String), expiryDate (Instant), and user (User).

A

public class RefreshToken {
  @Id
  private Long id;
  private String token;
  private Instant expiryDate;
  @OneToOne
  private User user;
}

B

public class RefreshToken {
  private Long id;
  private String token;
  private Date expiryDate;
  @OneToOne
  private User user;
}

C

public class RefreshToken {
  @Id
  private Long id;
  private String token;
  private Instant expiryDate;
  @ManyToOne
  private User user;
}

D

public class RefreshToken {
  @Id
  private Long id;
  private String token;
  private LocalDate expiryDate;
  @ManyToOne
  private User user;
}

💡 Hint

Check the correct annotation for user relationship and the type for expiryDate.

Option C correctly uses @Id for id, Instant for expiryDate, and @ManyToOne for user relationship which is typical for many tokens per user.

🔧 Debug

advanced

Why does this refresh token validation code throw NullPointerException?

Examine this code snippet that validates a refresh token. Why does it throw NullPointerException sometimes?

Spring Boot

public RefreshToken verifyExpiration(RefreshToken token) {
    if (token.getExpiryDate().compareTo(Instant.now()) < 0) {
        refreshTokenRepository.delete(token);
        throw new TokenRefreshException(token.getToken(), "Refresh token expired");
    }
    return token;
}

// token can be null if not found in DB

A Because token is null and token.getExpiryDate() causes NullPointerException

B Because Instant.now() returns null causing NullPointerException

C Because refreshTokenRepository.delete(token) is null causing NullPointerException

D Because token.getExpiryDate() is null causing NullPointerException

💡 Hint

Consider what happens if the token argument is null.

If token is null, calling token.getExpiryDate() causes NullPointerException. The method does not check for null before accessing token fields.

🧠 Conceptual

expert

What is the main security benefit of using a refresh token pattern in Spring Boot?

Why do applications use refresh tokens instead of just long-lived access tokens?

A Refresh tokens allow short-lived access tokens, reducing risk if access token is stolen

B Refresh tokens eliminate the need for user authentication entirely

C Refresh tokens store user passwords securely on the client side

D Refresh tokens allow unlimited access without expiration

💡 Hint

Think about what happens if an access token is stolen and how refresh tokens help.

Using refresh tokens allows access tokens to be short-lived, so if an access token is stolen, it expires quickly. The refresh token can be revoked to prevent further access.