RefreshTokenPersistence response in case of invalid refresh token

[l0co]

In 2.0.0.M3.

When a request to get a new access token with refresh token is sent to /oauth/access_token and underlying RefreshTokenPersistence can't find the refresh token because the token is invalid or expired, I return empty publisher from RefreshTokenPersistence.getUserDetails(). In such a scenario the response to the client is HTTP 500, while I believe it should be HTTP 401 with some additional info in body.

[sdelamo]

Hello @l0co

I have updated the JWT guide with an example.

https://guides.micronaut.io/micronaut-security-jwt/guide/index.html#refreshToken

Please, reopen if you consider the issue unresovled.

[l0co]

OK, I see. I'd also add info in RefreshTokenPersistence.getUserDetails() comment that in case of
any problem you should publish OauthErrorResponseException.