Spring Boot客户端Access Token存储方案咨询：替代Session存储的优化方案及最佳实践

Hey there! Let's walk through how to improve your access token handling since storing it directly in a user session doesn't make much sense here—especially since your TokenObtainer uses a service-level credential (not a user-specific one).

1. Better Contexts for Token Fetching & Storage #

1.1 Wrap Token Logic in a Dedicated Service Layer #

Instead of handling token operations in your controller, create a centralized service to manage token fetching, caching, and refreshing. This keeps your controllers focused on business logic and makes token management reusable across your app.

Here's an example TokenManagerService that adds caching to avoid repeated calls to the remote login service:

@Service
public class TokenManagerService {
    private final TokenObtainer tokenObtainer;
    private final Cache<String, String> tokenCache;

    public TokenManagerService(TokenObtainer tokenObtainer) {
        this.tokenObtainer = tokenObtainer;
        // Use Caffeine for in-memory caching (adjust expiry to match your token's TTL)
        this.tokenCache = Caffeine.newBuilder()
                .expireAfterWrite(30, TimeUnit.MINUTES)
                .build();
    }

    public String getValidToken() {
        // Fetch from cache first; if missing, call TokenObtainer and cache the result
        return tokenCache.get("service_access_token", key -> tokenObtainer.obtainToken());
    }

    // Manual refresh method if you need to invalidate the token early
    public void refreshToken() {
        String newToken = tokenObtainer.obtainToken();
        tokenCache.put("service_access_token", newToken);
    }
}

Then use this service in your controller cleanly:

@RestController
@RequestMapping("/service")
public class GnkServiceController {
    private final TokenManagerService tokenManagerService;

    @Autowired
    public GnkServiceController(TokenManagerService tokenManagerService) {
        this.tokenManagerService = tokenManagerService;
    }

    @GetMapping("/test")
    public String accessProtectedResource() {
        String token = tokenManagerService.getValidToken();
        // Use the token to call your target resource here
        return "Successfully accessed protected resource";
    }
}

1.2 Use a Request Interceptor for Auto-Token Injection #

If every request to your service needs the access token, create a HandlerInterceptor to fetch the token (from cache) automatically before the request reaches your controller. This removes token logic entirely from your controllers.

Example interceptor:

@Component
public class TokenInterceptor implements HandlerInterceptor {
    private final TokenManagerService tokenManagerService;

    public TokenInterceptor(TokenManagerService tokenManagerService) {
        this.tokenManagerService = tokenManagerService;
    }

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        String validToken = tokenManagerService.getValidToken();
        // Attach the token to the request for downstream use
        request.setAttribute("access_token", validToken);
        // Alternatively, if you're using RestTemplate to call external services, you could configure it here to add the token to headers
        return true;
    }
}

Register the interceptor in your web config:

@Configuration
public class WebConfig implements WebMvcConfigurer {
    private final TokenInterceptor tokenInterceptor;

    public WebConfig(TokenInterceptor tokenInterceptor) {
        this.tokenInterceptor = tokenInterceptor;
    }

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(tokenInterceptor)
                .addPathPatterns("/service/**"); // Apply to your protected endpoints
    }
}

1.3 Distributed Cache for Multi-Instance Apps #

If your app runs on multiple servers, replace the in-memory Caffeine cache with a distributed cache like Redis. Use Spring Cache annotations to simplify this:

@Service
public class TokenManagerService {
    private final TokenObtainer tokenObtainer;

    public TokenManagerService(TokenObtainer tokenObtainer) {
        this.tokenObtainer = tokenObtainer;
    }

    @Cacheable(value = "serviceTokens", key = "'service_access_token'")
    public String getValidToken() {
        return tokenObtainer.obtainToken();
    }

    @CacheEvict(value = "serviceTokens", key = "'service_access_token'")
    public void refreshToken() {
        // Clears the cache; next call will fetch a new token
    }
}

2. Recommended Token Storage Options #

Choose based on your app's deployment model and token requirements:

• In-memory cache (Caffeine/Guava Cache): Ideal for single-instance apps. Lightweight, fast, and supports automatic expiry matching your token's TTL.
• Distributed cache (Redis): Must-have for multi-instance deployments. Ensures all app instances use the same valid token, and supports expiry/refresh logic.
• Spring Session (with Redis): Only use this if your token is user-specific (not service-level). For service credentials, this is overkill since sessions are tied to individual user sessions.
• Configuration center (Nacos/Spring Cloud Config): Suitable if your token has a very long lifespan and requires manual updates (not recommended for short-lived tokens that need auto-refresh).

内容的提问来源于stack exchange，提问作者Frank