Refresh token pattern in Spring Boot - Mini Project: Build & Apply

Implement Refresh Token Pattern in Spring Boot

📖 Scenario: You are building a secure Spring Boot API that uses JWT tokens for authentication. To improve security and user experience, you want to implement the refresh token pattern. This pattern allows users to get a new access token without logging in again when the current access token expires.In this project, you will create the data structures, configuration, core logic, and final integration to support refresh tokens in your Spring Boot application.

🎯 Goal: Build a Spring Boot service that manages JWT access tokens and refresh tokens. You will create the data model for tokens, configure token expiration times, implement the logic to generate and validate refresh tokens, and complete the controller endpoint to issue new access tokens using refresh tokens.

📋 What You'll Learn

Create a data class to represent refresh tokens with fields for token string and expiry date

Add configuration variables for access token and refresh token expiration times

Implement a method to generate a new refresh token with expiry

Complete a REST controller endpoint to accept a refresh token and return a new access token

💡 Why This Matters

🌍 Real World

Refresh tokens are used in real-world applications to keep users logged in securely without asking them to enter credentials repeatedly.

💼 Career

Understanding and implementing refresh token patterns is essential for backend developers working on secure APIs and authentication systems.

1

Create RefreshToken data class

Create a Java record called RefreshToken with two fields: String token and Instant expiryDate.

Spring Boot

// Your code here

Hint

Use a Java record to hold the token string and its expiry date.

2

Add token expiration configuration

Add two long variables called accessTokenExpirationMs and refreshTokenExpirationMs with values 900000 and 604800000 respectively to represent expiration times in milliseconds.

Spring Boot

public record RefreshToken(String token, Instant expiryDate) {}

// Your code here

Hint

Set access token expiration to 15 minutes (900000 ms) and refresh token expiration to 7 days (604800000 ms).

3

Implement refresh token generation method

Write a method called generateRefreshToken that returns a RefreshToken. It should create a random UUID string for the token and set the expiry date to the current time plus refreshTokenExpirationMs milliseconds.

Spring Boot

public record RefreshToken(String token, Instant expiryDate) {}

long accessTokenExpirationMs = 900000L;
long refreshTokenExpirationMs = 604800000L;

// Your code here

Hint

Use UUID.randomUUID().toString() for token and Instant.now().plusMillis() for expiry.

4

Complete refresh token endpoint in controller

In a Spring REST controller, write a method refreshAccessToken that accepts a String refreshToken parameter. It should validate the token expiry by comparing with Instant.now() and return a new access token string if valid. Use accessTokenExpirationMs to set the new token expiry time.

Spring Boot

import java.time.Instant;
import java.util.UUID;

public record RefreshToken(String token, Instant expiryDate) {}

long accessTokenExpirationMs = 900000L;
long refreshTokenExpirationMs = 604800000L;

public RefreshToken generateRefreshToken() {
    String token = UUID.randomUUID().toString();
    Instant expiryDate = Instant.now().plusMillis(refreshTokenExpirationMs);
    return new RefreshToken(token, expiryDate);
}

// Your code here

Hint

Check if the refresh token expiry is before now to reject expired tokens. Return a new UUID string as the access token.

Practice

1.

What is the main purpose of using a refresh token in a Spring Boot authentication system?

easy

A. To encrypt user data in the database

B. To store user passwords securely

C. To log out users automatically after a timeout

D. To allow users to get a new access token without logging in again

Solution

1. Step 1: Understand the role of refresh tokens

   Refresh tokens are used to get new access tokens without asking the user to log in again.

2. Step 2: Compare options with this purpose

   Only To allow users to get a new access token without logging in again describes this purpose correctly; others describe unrelated functions.

3. Final Answer:

   To allow users to get a new access token without logging in again -> Option D

4. Quick Check:

   Refresh token purpose = renew access token [OK]

Hint: Refresh tokens renew access tokens without re-login [OK]

Common Mistakes:

• Confusing refresh token with password storage
• Thinking refresh token logs out users
• Assuming refresh token encrypts data

2.

Which of the following is the correct way to define a method in a Spring Boot controller to handle refresh token requests?

@PostMapping("/refresh")
public ResponseEntity<TokenResponse> refreshToken(@RequestBody RefreshRequest request) {
    // method body
}

easy

A. @GetMapping("/refresh") public TokenResponse refreshToken(@RequestBody RefreshRequest request)

B. @PostMapping("/refresh") public void refreshToken(String token)

C. @PostMapping("/refresh") public ResponseEntity<TokenResponse> refreshToken(@RequestBody RefreshRequest request)

D. @RequestMapping("/refresh") public String refreshToken()

Solution

1. Step 1: Check HTTP method and parameters

   The refresh token request should be a POST with a JSON body containing the refresh token.

2. Step 2: Match method signature

   @PostMapping("/refresh") public ResponseEntity<TokenResponse> refreshToken(@RequestBody RefreshRequest request) correctly uses @PostMapping, returns ResponseEntity<TokenResponse>, and accepts @RequestBody RefreshRequest.

3. Final Answer:

   @PostMapping("/refresh") public ResponseEntity<TokenResponse> refreshToken(@RequestBody RefreshRequest request) -> Option C

4. Quick Check:

   Correct POST method and request body = @PostMapping("/refresh") public ResponseEntity<TokenResponse> refreshToken(@RequestBody RefreshRequest request) [OK]

Hint: Refresh token requests use POST with @RequestBody [OK]

Common Mistakes:

• Using GET instead of POST
• Missing @RequestBody annotation
• Wrong return type or parameters

3.

Given the following Spring Boot service method, what will be the output if the refresh token is invalid?

public TokenResponse refreshAccessToken(String refreshToken) {
    if (!tokenRepository.existsByToken(refreshToken)) {
        throw new RuntimeException("Invalid refresh token");
    }
    // generate new access token
    return new TokenResponse("newAccessToken");
}

medium

A. Throws RuntimeException with message "Invalid refresh token"

B. Returns a new TokenResponse with "newAccessToken"

C. Returns null

D. Returns the old refresh token

Solution

1. Step 1: Analyze the token existence check

   The method checks if the refresh token exists in the repository; if not, it throws an exception.

2. Step 2: Determine behavior on invalid token

   Since the token is invalid, the method throws RuntimeException with the message "Invalid refresh token".

3. Final Answer:

   Throws RuntimeException with message "Invalid refresh token" -> Option A

4. Quick Check:

   Invalid token triggers exception = Throws RuntimeException with message "Invalid refresh token" [OK]

Hint: Invalid refresh token causes exception throw [OK]

Common Mistakes:

• Assuming method returns null on invalid token
• Thinking it returns old token instead
• Ignoring exception throwing

4.

Identify the error in this Spring Boot refresh token controller method:

@PostMapping("/refresh")
public ResponseEntity<TokenResponse> refreshToken(@RequestParam String refreshToken) {
    TokenResponse token = authService.refreshAccessToken(refreshToken);
    return ResponseEntity.ok(token);
}

What is the problem?

medium

A. Using @RequestParam instead of @RequestBody for refresh token

B. Missing @PostMapping annotation

C. Returning ResponseEntity instead of TokenResponse

D. Calling wrong service method

Solution

1. Step 1: Check parameter annotation

   The refresh token is usually sent in the request body as JSON, not as a query parameter.

2. Step 2: Identify correct annotation

   The method should use @RequestBody instead of @RequestParam to receive the refresh token properly.

3. Final Answer:

   Using @RequestParam instead of @RequestBody for refresh token -> Option A

4. Quick Check:

   Refresh token needs @RequestBody, not @RequestParam [OK]

Hint: Refresh token comes in body, use @RequestBody [OK]

Common Mistakes:

• Using query parameters for refresh token
• Confusing ResponseEntity with return type
• Missing or wrong annotations

5.

You want to implement a refresh token mechanism in Spring Boot that invalidates the old refresh token after use and issues a new one along with the access token. Which approach below correctly achieves this?

hard

A. Check refresh token validity, generate new access token, keep old refresh token unchanged

B. Generate new access token and new refresh token, save new refresh token, delete old refresh token

C. Generate new access token only, do not check refresh token validity

D. Delete refresh token without issuing new tokens

Solution

1. Step 1: Understand token rotation

   To improve security, the old refresh token should be invalidated and replaced with a new one after use.

2. Step 2: Identify correct token handling

   Generate new access token and new refresh token, save new refresh token, delete old refresh token correctly generates new access and refresh tokens, saves the new refresh token, and deletes the old one.

3. Final Answer:

   Generate new access token and new refresh token, save new refresh token, delete old refresh token -> Option B

4. Quick Check:

   Refresh token rotation = Generate new access token and new refresh token, save new refresh token, delete old refresh token [OK]

Hint: Rotate refresh tokens: new token saved, old token deleted [OK]

Common Mistakes:

• Not invalidating old refresh token
• Skipping refresh token validity check
• Deleting tokens without issuing new ones