DefaultTokenServices fail to store enhanced refresh token when refreshAccessToken method is invoked

226 views Asked by At

In contrast to the createAccessToken method where the enhanced version of the refresh token is saved, the refreshAccessToken method saves the refresh token without enhancements.

I believe the behaviour should be something on these lines:

OAuth2AccessToken accessToken = createAccessToken(authentication, refreshToken);
    tokenStore.storeAccessToken(accessToken, authentication);
    // In case it was modified
    refreshToken = accessToken.getRefreshToken();
    if (refreshToken != null) {
        tokenStore.storeRefreshToken(refreshToken, authentication);
    }
    return accessToken;

Can this be considered a bug?

I created an issue for this https://github.com/spring-projects/spring-security-oauth/issues/511

0

There are 0 answers