Spring框架中是否有自动刷新过期JWT Token的内置功能？

针对你的场景，Spring 可以通过Spring Security OAuth2 Client模块实现JWT的自动过期跟踪与刷新，无需手动通过RestTemplate/Feign Client处理令牌生命周期，具体实现方式如下：

1. 核心依赖配置 #

首先在SERVICE_C的依赖管理文件中引入Spring Security OAuth2 Client依赖：

<!-- Maven -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-client</artifactId>
</dependency>

2. 配置OAuth2客户端（指向API_B） #

在application.yml中配置SERVICE_C作为OAuth2客户端，将API_B视为授权服务器：

spring:
  security:
    oauth2:
      client:
        registration:
          api-a-client:
            client-id: your-service-c-client-id
            client-secret: your-service-c-client-secret
            authorization-grant-type: client_credentials # 根据实际场景选择，比如password/authorization_code
            scope: api-a-read api-a-write # 对应API_A要求的权限范围
        provider:
          api-a-client:
            token-uri: http://api-b-url/oauth2/token # API_B的令牌发放端点
            refresh-token-uri: http://api-b-url/oauth2/refresh # API_B的刷新令牌端点

注意：authorization-grant-type要和API_B支持的类型匹配，如果SERVICE_C是后台服务，通常用client_credentials；如果需要模拟用户身份，用password或authorization_code。

3. 集成RestTemplate自动携带并刷新令牌 #

通过OAuth2AuthorizedClientManager自动管理令牌，将其注入到RestTemplate的拦截器中：

@Configuration
public class RestTemplateConfig {

    @Bean
    public RestTemplate oAuth2RestTemplate(OAuth2AuthorizedClientManager authorizedClientManager) {
        OAuth2AuthorizationRequestInterceptor interceptor = new OAuth2AuthorizationRequestInterceptor(authorizedClientManager, "api-a-client");
        RestTemplate restTemplate = new RestTemplate();
        restTemplate.getInterceptors().add(interceptor);
        return restTemplate;
    }

    @Bean
    public OAuth2AuthorizedClientManager authorizedClientManager(ClientRegistrationRepository clientRegistrationRepository,
                                                               OAuth2AuthorizedClientService authorizedClientService) {
        OAuth2AuthorizedClientProvider authorizedClientProvider = OAuth2AuthorizedClientProviderBuilder.builder()
                .clientCredentials() // 对应配置的授权类型
                .refreshToken() // 启用刷新令牌支持
                .build();
        DefaultOAuth2AuthorizedClientManager authorizedClientManager = new DefaultOAuth2AuthorizedClientManager(clientRegistrationRepository, authorizedClientService);
        authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);
        return authorizedClientManager;
    }
}

使用这个RestTemplate调用API_A时，会自动从API_B获取JWT，当令牌过期时，自动使用Refresh Token换取新令牌，无需手动处理。

4. 集成Feign Client自动处理令牌 #

结合Spring Cloud OpenFeign，通过自定义请求拦截器实现令牌的自动注入与刷新：

@Component
public class OAuth2FeignInterceptor implements RequestInterceptor {

    private final OAuth2AuthorizedClientManager authorizedClientManager;

    public OAuth2FeignInterceptor(OAuth2AuthorizedClientManager authorizedClientManager) {
        this.authorizedClientManager = authorizedClientManager;
    }

    @Override
    public void apply(RequestTemplate template) {
        OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId("api-a-client")
                .principal(new AnonymousAuthenticationToken("anonymous", "anonymous", Collections.emptyList()))
                .build();
        OAuth2AuthorizedClient authorizedClient = authorizedClientManager.authorize(authorizeRequest);
        if (authorizedClient != null && authorizedClient.getAccessToken() != null) {
            template.header(HttpHeaders.AUTHORIZATION, "Bearer " + authorizedClient.getAccessToken().getTokenValue());
        }
    }
}

添加该拦截器后，Feign Client的请求会自动携带有效JWT，当令牌过期时，authorizedClientManager会自动触发刷新逻辑。

关键说明 #

• Spring Security OAuth2 Client会自动维护令牌的过期时间，无需手动跟踪；
• 刷新令牌的逻辑由框架自动处理，当检测到当前令牌即将过期或已过期时，会调用API_B的刷新端点获取新令牌；
• 上述方案适用于Spring Boot 2.2+版本，不同版本的API可能略有差异，需对应调整。

内容的提问来源于stack exchange，提问作者Ayush Gupta