Spring-boot Resource server validate token only when expired

Question

I`m developing a microservice structure using spring-boot, this structure has an external oauth2 Authorization Server and multiples Resource Servers.

My problem is, each http request to my resources, calls a url to my Authorization Server, to validate the token ( .../oauth/check_token/). This way there is a lot of requests. There is a way to validate/check this token only when it is expired?

My Resource servers:

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
    
    @Value("${security.oauth2.client.client-id}")
    private String clientId;
    
    @Value("${security.oauth2.client.client-secret}")
    private String clientSecret;
    
    @Value("${security.oauth2.resource.id}")
    private String resourceId;
    
    @Value("${security.oauth2.resource.token-info-uri}")
    private String tokenInfoUri;

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
            .antMatchers(ADMIN_ANT_MATCHER).hasRole("ADMIN")
            .antMatchers(PROTECTED_ANT_MATCHER).hasRole("USER")
            .and()
            .csrf().disable();
    }
    
    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
         resources.tokenServices(tokenService()).resourceId(resourceId).stateless(true);
    }
    
    @Bean
    @Primary
    public RemoteTokenServices tokenService() {
        RemoteTokenServices tokenService = new RemoteTokenServices();
        tokenService.setCheckTokenEndpointUrl(tokenInfoUri);
        tokenService.setClientId(clientId);
        tokenService.setClientSecret(clientSecret);
        return tokenService;
    }
}

Authorization Server:

@Configuration
@EnableAuthorizationServer
public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

    @Value("${security.oauth2.client.client-id}")
    private String clientId;

    @Value("${security.oauth2.client.client-secret}")
    private String clientSecret;

    @Value("${security.oauth2.resource.id}")
    private String resourceId;

    @Value("${security.oauth2.client.access-token-validity-seconds}")
    private Integer tokenValidateSeconds;

    @Value("${security.oauth2.client.token-secret}")
    private String tokenSecret;

    @Autowired
    private AuthenticationManager authenticationManager;

    @Autowired
    private TokenStore tokenStore;

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private OauthAccessTokenRepository oauthAccessTokenRepository;

    @Autowired
    private OauthRefreshTokenRepository oauthRefreshTokenRepository;


    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
        endpoints
                .tokenStore(this.tokenStore)
                .tokenEnhancer(tokenEnhancer())
                .authenticationManager(this.authenticationManager)
                .userDetailsService(userDetailsService);
    }

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        clients
                .inMemory()
                .withClient(clientId)
                .authorizedGrantTypes("client_credentials", "password", "refresh_token")
                .authorities("ROLE_USER","ROLE_ADMIN")
                .scopes("read","write","trust")
                .resourceIds(resourceId)
                .accessTokenValiditySeconds(tokenValidateSeconds)
                .secret(bCryptPasswordEncoder().encode(clientSecret));
    }

    @Override
    public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
        security.checkTokenAccess("isAuthenticated()");
    }

    @Bean
    public BCryptPasswordEncoder bCryptPasswordEncoder(){
        return new BCryptPasswordEncoder();
    }

    @Bean
    @Primary
    public DefaultTokenServices tokenServices() {
        DefaultTokenServices tokenServices = new DefaultTokenServices();
        tokenServices.setSupportRefreshToken(true);
        tokenServices.setTokenStore(this.tokenStore);
        return tokenServices;
    }

    @Bean
    public TokenEnhancer tokenEnhancer() {
        return new TokenEnhancer() {
            @Override
            public OAuth2AccessToken enhance(OAuth2AccessToken accessToken, OAuth2Authentication authentication) {
                CustomUser user = (CustomUser) authentication.getPrincipal();

                String token = JwtTokenHelper.generateToken(
                        user.getIdUser(),
                        user.getTenantID(),
                        user.getIdEntity(),
                        user.getIdBusinessUnit(),
                        user.getProfile(),
                        tokenValidateSeconds,
                        tokenSecret
                );

                ((DefaultOAuth2AccessToken) accessToken).setValue(token);

                return accessToken;
            }
        };

    }
}

Answer 1

You can remove the need to use the check_token endpoint, by using signed JWT tokens.

When the resource server receive a JWT token, it verify it's signature by using a public key, and the expiration date by checking the corresponding field in the JSON object.

For this you can use the JwtAccessTokenConverter, JwtTokenStore and the nimbus-jose-jwt library.

The downside of this approach is that you cannot revoke a token. It's then preferable to have short lived tokens.