I'm using Spring Boot and Spotify as an OAuth2 provider. Users will be redirected to Spotify to authorize and my application will use the Spotify API.
I hook to the AuthenticationSuccessEvent to obtain the access token and use it with the Spotify API.
As far as I can see Spring Boot doesn't refresh the access token by itself.
Sadly the refresh_token to actually refresh the access token is not stored in the OAuth2Authentication where I get the access token from.
I looked into the code of spring-security-oauth
in the class OAuth2ClientAuthenticationProcessingFilter that handles the authentication and it seems like that the refresh token is not stored anywhere by Spring.
I can't just redirect the user back to the login page, which would result in a complete new access token and refresh token, because my application is meant to be headless after the initial authentication.
Is there any way to intercept here and obtain the refresh token? Is there maybe a better way to have Spring refresh the token itself?