Spring Security - Refresh token

In this tutorial, we demonstrate how to implement a refresh token mechanism in a Spring Boot application secured with JSON Web Tokens (JWT). Refresh tokens improve the security and user experience of your application by allowing clients to request new access tokens without requiring users to re-authenticate every time their access token expires.

By the end of this video, you'll have a solid understanding of how to implement a refresh token mechanism within your Spring Boot application, providing a more secure and seamless experience for your users.

Don't forget to like, comment, and subscribe to our channel for more in-depth tutorials on Spring Boot, JWT authentication, and other programming topics!

Don't Forget to
===========================================
💯 Subscribe to the youtube channel

Table of content
00:00 Intro
01:00 What is refresh token
03:47 Extend the AuthenticationResponse
06:07 Extract JWT properties
09:31 Create refresh token method
12:07 Adjust the register and authenticate endpoints
14:10 Add refresh token endpoint
14:44 Implement the refresh token mechanism
22:08 Revoke the newly generated token
22:56 Test the changes
35:49 Thanks for watchin

[sachin.tandon]

This is great! One of the best tutorials I've seen on this. I wondred, whether in your series, you might consider teaching how to implement login with email validation, but instead of angular receiving the tokens, a Spring BFF, with say an Auth Provider like KeyCloak...

[firibuanyass]

Great Bouali Ali. I did watch your previous videos and I read the comments on the Refresh token. And here you go everyone he delivered as you asked for. Such an inspiration. Keep up the great work.

[anirudh]

This video is very useful, thank you very much!!

[surge]

Finished your spring security course and i was wondering how to implement refresh tokens. You read my mind. Thanks for this

[hamzaelbouzidi]

شكرا جزيلا على مجهودك. اتمنى ان لا تنسى المجتمع العربي من شرحك <3

[tresorkaleto]

you wait for JWT and aouth2 authentication together implementations.
thank you for sharing.

[seksky]

Really appreciated you created this tutorial for the latest Spring boot version.Right timing for me to pick up more backend skills.

[loicsan]

One of the best trainers for sure.

I would just like to see your way of doing this authentication with angular; because your way is always very optimal and understandable.

[abu-dukhan]

I'm actually speechless Ali, thank you so so much for your effort in providing such awesome content.

And please if you'll make a video that dive into CSRF it'll be really useful, I mean the CSRF is important when it comes to security right.
Because most of the video out there just disable it and then move on, without giving why and what should be the best practices on that at the dev environment.

Thank you once again for the contents ❤❤❤

[sserra]

Thank you, I will use it for my university project. portuguese here

[bartosztoropolski]

i love it <3 You're the best :D

[balazsvarga]

Again a great content. But I have two question to it:

1. In the method refreshToken why we use ObjectMapper instead of returning the AuthorizationResponse like we do it if we register or log in?

2. If I understand it correctly, the whole point of a refresh token is to send a new access token, if the old is no more valid. I miss this workflow from the video. I mean there should be a common method, which checks, if the access token belongs to the right user, but it is expired, and if so, then call the refreshToken method and with the new access token let the user access the restricted resource. Because now if we hit the demo controller, we get only a token expired exception. And I think, in this case, we should call the refreshToken method. And this generally for all secured endpoint. Maybe in a common exception handling, where we catch the token expired exception. This would be a kind of silent re-login. What do you think?

[bryanguzman]

This is a great content, thank you so so much.

[dagnogoyaya]

Thanks for this sir ! Please do we have a course on sending email when a user creates an account🤩🙏

[johancamacho]

Great video ! thanks for sharing this!

[DR.EAM.CHASER]

Great content as always :) I'm still waiting for the Swagger interation. I hope you still find time for it :)

[Great_Sahara]

thank you for the great content. Can you please make a tutorial about online payement with spring boot and angular . TKU

[IanCheng-bdrm]

25:20 Can add " " before " new ObjectMapper().writeValue(response.getOutputStream(), authResponse); "

[DungNguyen-kicr]

Thank you for nice tutorial. But may i ask you a question that should we save the refresh token in db like we save the access token? if not (only store access token in cookie or anything regarding to client-side), what will happen, it it secured like when we log out the refresh token will be revoked in some how? Thank you in advanced!

[Quasar]

Please correct me if I am wrong: For the front end I should be using the refresh token endpoint whenever I receive a 403 when using the access token then resend the same request with the new access token. And if I receive a 403 on the refresh token endpoint that's when I log out the user from my app (I am using a mobile app for the front end and spring boot for the backend)