Currently we are debating over securing our multiple micro-services. The major concern is that the JWT token provided to us will expire before the call is finished. (This is in the synchronous design) Here are three proposals:
- Client App has an 'ensure(int minutes)' method before lengthy calls, calling token provider if necessary. Let JWT expire if it hits security filter.
- Client App sends both JWT and Refresh Token. If JWT expires, use refresh token to get new one and place on response headers via token provider.
- Create "login" service. Login caches refresh info and returns JWT. Send old JWT to get a refreshed JWT via token provider.
Thoughts? Note: My vote is for #1. The rest seem insecure, but convenient.