SpringBoot and Keycloak configuration for REST API authentication

[serafeimo]

Hi all!

We integrate our spring boot application with Keycloak in order to restrict access to specific URLs based on roles. After applying the configuration and authenticating the requests based on url pattern, we noticed that the bearer token that is provided is getting checked against Keycloak only during the first call. After that, and for all subsequent calls, no checks are being performed against Keycloak but it just checks the token based on the data it retrieved from the first call. That means that if Keycloak goes off and the token has not expired, it can be used in future calls without any problem. Is that logical? Is there a way to check against Keycloak in every call?

Our setup and configuration is similar to what is described here: https://gauthier-cassany.com/posts/spring-boot-keycloak

Thank you!