Handling OAuth 2.0 access token

Question

I am creating a rest template to consume REST API secured by OAuth 2.0.

The provider has implemented an expiry for the access token for 5 mins. So Using the rest template, I will be calling the database and sending records via Rest Template.

The records may vary from 10k to 1 million, so I wanted to create a fault proof system. In the process of sending records even if the token expires, I should be sending the records to the server.

What is the best way of achieving this?

Any help or inputs are highly appreciated.

Answer 1

Authentication and authorization are typically checked while handling a request. Unless you have specific requirements specifying that you must do something more, keep it simple. Trying to do this kind of check during the response processing is going to really increase the complexity of the API.

Remember that there's nothing magical about the 300 seconds. The point of having a short time-out on tokens is to prevent attackers from scavenging old tokens and using them.

Again, your requirements could specify otherwise but if they don't, it's a standard assumption that you are only checking for this when handling the request, not during the handling of the response.