title: How to silently refresh expired JWT token with OAuth2?
body: <p>We have decided to switch from Hazelcast shared session to Stateless JWT authentication/authorization with OAuth2 and found out a problem that doesnt fit our infrastructure described below.</p>
  
  <p><a href="https://i.stack.imgur.com/pLIL5.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/pLIL5.png" alt="Current Hazelcast shared session"></a></p>
  
  <p>So we have multiple Self-contained systems (scs) that may be accessed by direct link i.e. <em>mysite.com/scs1</em> and <em>mysite.com/scs2</em>. </p>
  
  <p><a href="https://i.stack.imgur.com/qVsxd.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/qVsxd.png" alt="Stateless JWT so called Session"></a></p>
  
  <p>Each scs has it's own UI and BackEnd, but "session" (implemented via Stateless JWT Authorization) has to be valid across multiple scs'es.</p>
  
  <p>OAuth2 Authorizaion Server is a dedicated server (UAA).
  In the OAuth2 terminology, each scs is a Resource Server.</p>
  
  <p>Let's assume that user has logged into <strong>scs1</strong> (via UAA) and got JWT with TTL=10 minutes and RefreshToken with TTL=30 minutes. Then he leaves that tab in browser for 15 minutes. JWT expires, but the tab still contains the previous page from <strong>scs1</strong>. And user clicks a link on that page that follows to <em>mysite.com/scs3</em>.</p>
  
  <p><strong>scs3</strong> receives a request, checks JWT and finds out that it has expired. But we have a RefreshToken (still alive for 15 minutes) that may refresh JWT.</p>
  
  <p>Is it possible to return a response from <strong>scs3</strong> that would ask browser to go to UAA and silently refresh JWT ?</p>
  
  <p><a href="https://i.stack.imgur.com/GicBn.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/GicBn.png" alt="JWT has expired"></a></p>
  
  <p>Maybe some kind of REDIRECT to /uaa/authorization with an ability to add RefreshToken Header?</p>