Refreshing JWTs and Signing Out with Java's HttpClient and Gson

Refreshing JWTs and Signing Out

Welcome to this lesson on refreshing JWTs and signing out from APIs. Building on our previous discussion about JWT Authentication, where we focused on obtaining and utilizing JSON Web Tokens (JWTs) for stateless API authentication, we now explore more advanced aspects. In particular, we'll focus on refresh tokens, a crucial component in maintaining session continuity and providing seamless user experiences. Refresh tokens allow clients to obtain new access tokens without requiring user reauthentication, thereby ensuring uninterrupted access to protected resources. Our objectives today include learning how to refresh JWTs and securely sign out, all to ensure a robust and secure authentication workflow. Let's get started on mastering these important concepts.

Recap: Logging In and Extracting Tokens

As a reminder, JWTs are integral to stateless authentication, often chosen for their scalability and flexibility. Access tokens, a key part of JWT-based systems, are short-lived to minimize the risk of unauthorized access if they are ever leaked. Before diving into refreshing tokens, let's revisit the process of logging in to obtain both access and refresh tokens. In this example, we'll send a POST login request and extract tokens from the response. Here’s how it unfolds: Javaimport java.net.URI; import java.net.http.HttpClient; import java.net.http.HttpRequest; import java.net.http.HttpResponse; import com.google.gson.Gson; public class ApiClient { private static final String BASE_URL = "http://localhost:8000"; private static final Gson gson = new Gson(); public static void main(String[] args) { String username = "johnsmith"; String password = "testpass123"; try { UserCredentials userCredentials = new UserCredentials(username, password); HttpClient client = HttpClient.newHttpClient(); HttpRequest request = HttpRequest.newBuilder() .uri(new URI(BASE_URL + "/auth/login")) .POST(HttpRequest.BodyPublishers.ofString(gson.toJson(userCredentials))) .header("Content-Type", "application/json") .build(); HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString()); if(response.statusCode() != 200) { throw new Exception("Failed to login: " + response.body()); } AuthTokens authTokens = gson.fromJson(response.body(), AuthTokens.class); System.out.println("Access Token: " + authTokens.accessToken); System.out.println("Refresh Token: " + authTokens.refreshToken); } catch (Exception e) { e.printStackTrace(); } } } In this snippet, we've sent a login request and successfully extracted the access and refresh tokens. These tokens are vital for interacting with protected endpoints and setting the stage for the refreshing process.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Refreshing Tokens: Implementation

To maintain continuous access without forcing users to sign in repeatedly, we employ refresh tokens. These longer-lived tokens enable applications to request a fresh access token once the previous one expires.

With our previously obtained refresh token, we can request a new access token through the refresh process using the /auth/refresh route. It is common practice to send the refresh token in the body of the request for security reasons, minimizing exposure in URLs or headers:

Java

public class TokenRefresher {

    private static final String BASE_URL = "http://localhost:8000";
    private static final Gson gson = new Gson();

    public static void main(String[] args) {
        String refreshToken = "YourPreviouslyObtainedRefreshToken";

        try {
            JsonObject refreshRequestJson = new JsonObject();
            refreshRequestJson.addProperty("refresh_token", refreshToken);
            String refreshRequestBody = refreshRequestJson.toString();

            HttpClient client = HttpClient.newHttpClient();
            HttpRequest request = HttpRequest.newBuilder()
                    .uri(new URI(BASE_URL + "/auth/refresh"))
                    .POST(HttpRequest.BodyPublishers.ofString(refreshRequestBody))
                    .header("Content-Type", "application/json")
                    .build();

            HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
            if(response.statusCode() != 200) {
                throw new Exception("Failed to refresh session: " + response.body());
            }
            
            AuthTokens authTokens = gson.fromJson(response.body(), AuthTokens.class);
            System.out.println("Refreshed session");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

public class TokenRefresher {

    private static final String BASE_URL = "http://localhost:8000";
    private static final Gson gson = new Gson();

    public static void main(String[] args) {
        String refreshToken = "YourPreviouslyObtainedRefreshToken";

        try {
            JsonObject refreshRequestJson = new JsonObject();
            refreshRequestJson.addProperty("refresh_token", refreshToken);
            String refreshRequestBody = refreshRequestJson.toString();

            HttpClient client = HttpClient.newHttpClient();
            HttpRequest request = HttpRequest.newBuilder()
                    .uri(new URI(BASE_URL + "/auth/refresh"))
                    .POST(HttpRequest.BodyPublishers.ofString(refreshRequestBody))
                    .header("Content-Type", "application/json")
                    .build();

            HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
            if(response.statusCode() != 200) {
                throw new Exception("Failed to refresh session: " + response.body());
            }
            
            AuthTokens authTokens = gson.fromJson(response.body(), AuthTokens.class);
            System.out.println("Refreshed session");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Upon executing the refresh request, we receive a new access token, and in our case, the refresh token is also updated by the server for enhanced security. Upon successful token refresh, you should see an output confirming that the tokens have been updated successfully. Now you can proceed accessing protected endpoints with the newly refreshed access token as before.

Signing Out and Token Invalidation: Implementation Example

Beyond refreshing tokens, signing out from an application is equally crucial as it invalidates current tokens, preventing unauthorized access if they fall into the wrong hands. Signing out serves as an integral part of maintaining security and ending a user session.

By issuing a POST request to the logout endpoint, we revoke access tokens on the server, often using the refresh token to identify the session:

Java

public class UserLogout {
    private static final String BASE_URL = "http://localhost:8000";

    public static void main(String[] args) {
        String accessToken = "YourAccessToken";
        String refreshToken = "YourRefreshToken";

        try {
            JsonObject logoutRequestJson = new JsonObject();
            logoutRequestJson.addProperty("refresh_token", refreshToken);
            String logoutRequestBody = logoutRequestJson.toString();

            HttpClient client = HttpClient.newHttpClient();
            HttpRequest request = HttpRequest.newBuilder()
                    .uri(new URI(BASE_URL + "/auth/logout"))
                    .header("Authorization", "Bearer " + accessToken)
                    .POST(HttpRequest.BodyPublishers.ofString(logoutRequestBody))
                    .header("Content-Type", "application/json")
                    .build();

            HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
            
            if (response.statusCode() != 200) {
                throw new Exception("Failed to logout: " + response.body());
            }

            System.out.println("Logged out successfully!");

        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

public class UserLogout {
    private static final String BASE_URL = "http://localhost:8000";

    public static void main(String[] args) {
        String accessToken = "YourAccessToken";
        String refreshToken = "YourRefreshToken";

        try {
            JsonObject logoutRequestJson = new JsonObject();
            logoutRequestJson.addProperty("refresh_token", refreshToken);
            String logoutRequestBody = logoutRequestJson.toString();

            HttpClient client = HttpClient.newHttpClient();
            HttpRequest request = HttpRequest.newBuilder()
                    .uri(new URI(BASE_URL + "/auth/logout"))
                    .header("Authorization", "Bearer " + accessToken)
                    .POST(HttpRequest.BodyPublishers.ofString(logoutRequestBody))
                    .header("Content-Type", "application/json")
                    .build();

            HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
            
            if (response.statusCode() != 200) {
                throw new Exception("Failed to logout: " + response.body());
            }

            System.out.println("Logged out successfully!");

        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Upon successful logout, the application invalidates the session both client-side and server-side. This prevents any further use of revoked tokens, ensuring security. Attempting the refresh the token after logout will yield an Unauthorized response.

Refreshing JWTs and Signing Out with Java's HttpClient and Gson