Refresh token pattern in Spring Boot - Step-by-Step Execution

Concept Flow - Refresh token pattern

User logs in

↓

Server issues Access Token + Refresh Token

↓

User uses Access Token to access resources

↓

Access Token expires?

No→Continue using Access Token

Yes↓

User sends Refresh Token to server

↓

Server validates Refresh Token

↓

Refresh Token valid?

No→Reject request, ask login

Yes↓

Server issues new Access Token (and optionally new Refresh Token)

↓

User continues with new Access Token

This flow shows how a user logs in, receives tokens, uses the access token until it expires, then uses the refresh token to get a new access token without logging in again.

Execution Sample

Spring Boot

POST /login -> issue accessToken + refreshToken
GET /resource with accessToken
If accessToken expired:
POST /refresh with refreshToken -> issue new accessToken

This code flow shows login issuing tokens, resource access with access token, and refreshing access token using refresh token.

Execution Table

Step	Action	Token State	Server Response	User Action
1	User logs in	No tokens	Issues accessToken + refreshToken	Stores tokens
2	User requests resource	accessToken valid	Resource data	Uses resource
3	Access token expires	accessToken expired	401 Unauthorized	Sends refreshToken
4	Server validates refreshToken	refreshToken valid	Issues new accessToken	Stores new accessToken
5	User requests resource again	new accessToken valid	Resource data	Uses resource
6	Refresh token invalid or expired	refreshToken invalid	401 Unauthorized	User must login again

💡 Process stops when refresh token is invalid or user logs out.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	Final
accessToken	null	valid	valid	expired	new valid	valid	valid
refreshToken	null	valid	valid	valid	valid	valid	valid or invalid

Key Moments - 3 Insights

Why can't the user keep using the access token after it expires?

Because the access token is no longer valid (see Step 3 in execution_table), the server rejects requests with 401 Unauthorized to protect resources.

What happens if the refresh token is invalid or expired?

The server rejects the refresh request (Step 6), forcing the user to log in again to get new tokens.

Why do we need both access and refresh tokens?

Access tokens are short-lived for security; refresh tokens allow getting new access tokens without logging in again, improving user experience (see flow in concept_flow).

Visual Quiz - 3 Questions

Look at the execution_table, what is the server response at Step 3 when the access token expires?

A Issues new access token

B 401 Unauthorized

C Resource data

D Redirect to login page

💡 Hint

Check the 'Server Response' column at Step 3 in execution_table

At which step does the user send the refresh token to the server?

A Step 3

B Step 2

C Step 4

D Step 5

💡 Hint

Look at the 'User Action' column in execution_table for when refreshToken is sent

If the refresh token becomes invalid, what must the user do next?

A Continue using expired access token

B Request new access token with refresh token

C Log in again to get new tokens

D Nothing, tokens auto-renew

💡 Hint

See Step 6 in execution_table and key_moments about invalid refresh token

Concept Snapshot

Refresh Token Pattern in Spring Boot:
- User logs in, server issues access + refresh tokens.
- Access token used for resource access, short-lived.
- When access token expires, user sends refresh token.
- Server validates refresh token, issues new access token.
- If refresh token invalid, user must log in again.
- Improves security and user experience.

Full Transcript

The refresh token pattern helps keep users logged in securely. When a user logs in, the server gives two tokens: an access token and a refresh token. The access token lets the user access resources but expires quickly for safety. When it expires, the user sends the refresh token to get a new access token without logging in again. If the refresh token is invalid or expired, the user must log in again. This flow balances security and convenience by limiting how long access tokens last but allowing easy renewal.