In contrast to the createAccessToken
method where the enhanced version of the refresh token is saved, the refreshAccessToken
method saves the refresh token without enhancements.
I believe the behaviour should be something on these lines:
OAuth2AccessToken accessToken = createAccessToken(authentication, refreshToken);
tokenStore.storeAccessToken(accessToken, authentication);
// In case it was modified
refreshToken = accessToken.getRefreshToken();
if (refreshToken != null) {
tokenStore.storeRefreshToken(refreshToken, authentication);
}
return accessToken;
Can this be considered a bug?
I created an issue for this https://github.com/spring-projects/spring-security-oauth/issues/511