Answer the question
In order to leave comments, you need to log in
What is the correct way to cancel authorization after the expiration of the token lifetime?
There is an authorization service on Spring Security
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
clients.inMemory()
.withClient("...")
.secret("...")
.autoApprove(true)
.authorizedGrantTypes("password", "authorization_code", "refresh_token")
.scopes("read","write")
.accessTokenValiditySeconds(5)
.refreshTokenValiditySeconds(60);
}
public void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
.logout().deleteCookies("JSESSIONID").invalidateHttpSession(true).clearAuthentication(true).permitAll()
.and().antMatcher("/**").authorizeRequests()
.antMatchers("/login", "/logout").permitAll()
.anyRequest().authenticated();
}
Answer the question
In order to leave comments, you need to log in
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question