Refresh token pattern in Spring Boot - Mini Project: Build & Apply

Implement Refresh Token Pattern in Spring Boot

📖 Scenario: You are building a secure Spring Boot API that uses JWT tokens for authentication. To improve security and user experience, you want to implement the refresh token pattern. This pattern allows users to get a new access token without logging in again when the current access token expires.In this project, you will create the data structures, configuration, core logic, and final integration to support refresh tokens in your Spring Boot application.

🎯 Goal: Build a Spring Boot service that manages JWT access tokens and refresh tokens. You will create the data model for tokens, configure token expiration times, implement the logic to generate and validate refresh tokens, and complete the controller endpoint to issue new access tokens using refresh tokens.

📋 What You'll Learn

Create a data class to represent refresh tokens with fields for token string and expiry date

Add configuration variables for access token and refresh token expiration times

Implement a method to generate a new refresh token with expiry

Complete a REST controller endpoint to accept a refresh token and return a new access token

💡 Why This Matters

🌍 Real World

Refresh tokens are used in real-world applications to keep users logged in securely without asking them to enter credentials repeatedly.

💼 Career

Understanding and implementing refresh token patterns is essential for backend developers working on secure APIs and authentication systems.

1

Create RefreshToken data class

Create a Java record called RefreshToken with two fields: String token and Instant expiryDate.

Spring Boot

// Your code here

Need a hint?

Use a Java record to hold the token string and its expiry date.

2

Add token expiration configuration

Add two long variables called accessTokenExpirationMs and refreshTokenExpirationMs with values 900000 and 604800000 respectively to represent expiration times in milliseconds.

Spring Boot

public record RefreshToken(String token, Instant expiryDate) {}

// Your code here

Need a hint?

Set access token expiration to 15 minutes (900000 ms) and refresh token expiration to 7 days (604800000 ms).

3

Implement refresh token generation method

Write a method called generateRefreshToken that returns a RefreshToken. It should create a random UUID string for the token and set the expiry date to the current time plus refreshTokenExpirationMs milliseconds.

Spring Boot

public record RefreshToken(String token, Instant expiryDate) {}

long accessTokenExpirationMs = 900000L;
long refreshTokenExpirationMs = 604800000L;

// Your code here

Need a hint?

Use UUID.randomUUID().toString() for token and Instant.now().plusMillis() for expiry.

4

Complete refresh token endpoint in controller

In a Spring REST controller, write a method refreshAccessToken that accepts a String refreshToken parameter. It should validate the token expiry by comparing with Instant.now() and return a new access token string if valid. Use accessTokenExpirationMs to set the new token expiry time.

Spring Boot

import java.time.Instant;
import java.util.UUID;

public record RefreshToken(String token, Instant expiryDate) {}

long accessTokenExpirationMs = 900000L;
long refreshTokenExpirationMs = 604800000L;

public RefreshToken generateRefreshToken() {
    String token = UUID.randomUUID().toString();
    Instant expiryDate = Instant.now().plusMillis(refreshTokenExpirationMs);
    return new RefreshToken(token, expiryDate);
}

// Your code here

Need a hint?

Check if the refresh token expiry is before now to reject expired tokens. Return a new UUID string as the access token.