Dantooine (BFF) - Checking Access Token Expiration

[realisable]

Confirm you've already contributed to this project or that you sponsor it

• [X] I confirm I'm a sponsor or a contributor

Version

5.7.0

Question

In the Dantooine server example, there is a comment which reads 'In a real world application, the expiration date of the access token should be checked before sending a request to avoid getting a 401 response. Once expired, a new access token could be retrieved using the OAuth 2.0 refresh token grant (which could be done transparently).'

Do you have an example or some guidance of how to do this? (At this point in the request we only have 3 claims on the HttpContext.User object).

Many Thanks

[kevinchalet]

Hey @realisable,

Thanks a lot for sponsoring the project! ❤️

Do you have an example or some guidance of how to do this? (At this point in the request we only have 3 claims on the HttpContext.User object).

I updated the Dantooine sample to use a custom DelegatingHandler that detects whether an existing access token is about to expire and automatically refresh tokens via OpenIddictClientService.AuthenticateWithRefreshTokenAsync() when the token is known to be expired or when a 401 response was returned by the authorization server. It also now includes code to return a refreshed authentication cookie containing the new tokens when a grant_type=refresh_token request was sent: https://github.com/openiddict/openiddict-samples/pull/332.

Hope you'll find it useful 😃

Cheers.

[realisable]

Kevin, thank you. That is awesome!