Access Tokens

Access Token Flow

1. User logs in
2. Server generates short-lived access token (15 min)
3. Client sends token with requests
4. Server validates token
5. When expired, use refresh token to get new access token

Token Validation

@GetMapping("/protected")
public ResponseEntity<?> protectedEndpoint(
        @RequestHeader("Authorization") String authHeader) {
    String token = authHeader.replace("Bearer ", "");
    if (!tokenService.validate(token)) {
        return ResponseEntity.status(401).build();
    }
    Claims claims = tokenService.parse(token);
    return ResponseEntity.ok("Hello " + claims.getSubject());
}

Token Lifecycle

1. Generation: Create with short expiry
2. Validation: Verify signature and claims
3. Refresh: Exchange refresh token for new access token
4. Revocation: Invalidate on logout/security events

Storage

• Access tokens: Memory or short-lived storage
• Refresh tokens: Secure HTTP-only cookies
• Revoked tokens: Redis blacklist with TTL

Best Practices

• Rotate signing keys regularly
• Implement token binding
• Monitor token usage patterns

Key Points

• Understanding Access Tokens is essential for production systems
• Always consider scalability and maintainability
• Test thoroughly before deploying to production
• Monitor performance and set up alerting

Common Patterns

1. Validation: Always validate input at the boundary
2. Error Handling: Use structured error responses
3. Logging: Log key events for debugging
4. Testing: Unit, integration, and load tests
5. Documentation: Keep docs updated with code changes