Token endpoint issues a new token on every call (refresh/cache not honored) #12677

Environment ASP.NET Zero version: 15.3 Project type: [Core MVC & jQuery] .NET version: [.NET 10] Auth mechanism: TokenAuth (JWT Bearer) with refresh token Cache provider: [In-memory] Topology: Two separate applications. App A calls App B's /api/TokenAuth/Authenticate and /api/TokenAuth/RefreshToken as a service/integration account. Deployment: [multiple instances]

Hi, App A authenticates against App B as a service/integration account through POST /api/TokenAuth/Authenticate, caches the returned token in ICacheManager, and is supposed to reuse that cached token until it's close to expiry. When the access token is about to expire (or App B returns 401), App A calls POST /api/TokenAuth/RefreshToken and keeps going with the refreshed token.

The problem is that in practice a brand-new token seems to be issued on almost every call. It behaves as if the cached token is never reused and the refresh path is never taken — every request ends up going through a full Authenticate again.

What we expected:

• The cached access token is reused until it's near expiry (based on expireInSeconds).
• On expiry / 401, RefreshToken returns a new access token while the same refresh token stays valid until its own expiration.
• A full Authenticate only happens once the refresh token itself has expired.

What we actually see:

• A new token is generated on (almost) every request, as if either the cache is never hit or the previously issued token/refresh token is invalidated immediately.

What we've already done on our side:

• The token is cached in ICacheManager with an expiry derived from expireInSeconds (minus a 60-second safety buffer).
• The refresh path is guarded by a SemaphoreSlim with a double-check inside the lock, so concurrent requests shouldn't each trigger their own Authenticate.
• We logged the cached token and confirmed AccessTokenExpiresAt is being set, and checked that expireInSeconds is deserialized correctly from the Authenticate response.

We'd appreciate your guidance on the following:

1. In 15.3, does POST /api/TokenAuth/RefreshToken rotate the refresh token (issue a new one and invalidate the old), or is the same refresh token reusable until RefreshTokenExpiration? Which setting controls this behavior?
2. What are the correct settings for our scenario under Authentication:JwtBearer:* (e.g. Expiration, RefreshTokenExpiration, SecurityTokenKey)?
3. Are there any server-side mechanisms — TokenValidityKey, security stamp, single-use / one-time refresh tokens — that invalidate the previously issued token whenever a new Authenticate or RefreshToken call is made?
4. Since this is app-to-app (service account) communication and the token needs to be reused across requests/instances, what is the recommended pattern? Should the token be shared through a distributed cache (Redis) instead of the default in-memory ICacheManager?

The sanitized client-side code (business names replaced, token/auth/cache logic unchanged) is below.

Thanks in advance.

`public class IntegrationTokenManager : IIntegrationTokenManager { private readonly ICacheManager _cacheManager; private static readonly SemaphoreSlim _tokenLock = new SemaphoreSlim(1, 1); private const int TokenExpiryBufferSeconds = 60;

public IntegrationTokenManager(ICacheManager cacheManager)
{
    _cacheManager = cacheManager;
}

private async Task<string> PostWithAutoRefresh(string url, object data)
{
    var token = await GetValidToken();

    using var client = new HttpClient();
    client.DefaultRequestHeaders.Authorization =
        new AuthenticationHeaderValue("Bearer", token.Result.AccessToken);

    var content = new StringContent(JsonSerializer.Serialize(data), Encoding.UTF8, "application/json");
    var response = await client.PostAsync(url, content);

    if (response.StatusCode == System.Net.HttpStatusCode.Unauthorized)
    {
        try
        {
            var refreshedToken = await RefreshAccessToken(token.Result.RefreshToken);
            PreserveRefreshTokenIfMissing(refreshedToken, token);
            token = refreshedToken;
        }
        catch
        {
            token = await GetAccessToken();
        }

        await SaveTokenToCache(token);
        client.DefaultRequestHeaders.Authorization =
            new AuthenticationHeaderValue("Bearer", token.Result.AccessToken);
        content = new StringContent(JsonSerializer.Serialize(data), Encoding.UTF8, "application/json");
        response = await client.PostAsync(url, content);
    }

    if (!response.IsSuccessStatusCode)
        throw new Exception($"Request failed: {response.StatusCode}");

    return await response.Content.ReadAsStringAsync();
}

private async Task<ExternalAuthToken> GetAccessToken()
{
    using var httpClient = new HttpClient();
    var requestData = new
    {
        userNameOrEmailAddress = ExternalApiSettings.Username,
        password = ExternalApiSettings.Password,
        isIntegrationRequest = true
    };

    var requestContent = new StringContent(
        Newtonsoft.Json.JsonConvert.SerializeObject(requestData),
        Encoding.UTF8, "application/json");

    var response = await httpClient.PostAsync(
        $"{ExternalApiSettings.BaseUrl}api/TokenAuth/Authenticate", requestContent);

    if (!response.IsSuccessStatusCode)
    {
        var errorContent = await response.Content.ReadAsStringAsync();
        throw new Exception($"Authenticate failed. StatusCode: {response.StatusCode}, Response: {errorContent}");
    }

    var responseContent = await response.Content.ReadAsStringAsync();
    var tokenResponse = Newtonsoft.Json.JsonConvert.DeserializeObject<ExternalAuthToken>(responseContent);

    if (tokenResponse == null || !tokenResponse.Success)
        throw new Exception("Token response could not be deserialized or success=false.");

    return tokenResponse;
}

private async Task<ExternalAuthToken> RefreshAccessToken(string refreshToken)
{
    using var httpClient = new HttpClient();
    var response = await httpClient.PostAsync(
        $"{ExternalApiSettings.BaseUrl}api/TokenAuth/RefreshToken?refreshToken={Uri.EscapeDataString(refreshToken)}",
        null);

    if (!response.IsSuccessStatusCode)
        throw new Exception("RefreshToken request failed.");

    var responseContent = await response.Content.ReadAsStringAsync();
    var tokenResponse = Newtonsoft.Json.JsonConvert.DeserializeObject<ExternalAuthToken>(responseContent);

    if (tokenResponse == null || !tokenResponse.Success)
        throw new Exception("RefreshToken response failed.");

    return tokenResponse;
}

private async Task<ExternalAuthToken> GetValidToken()
{
    var cache = _cacheManager.GetCache(IntegrationConsts.TokenCacheName);
    var cached = await cache.GetOrDefaultAsync(IntegrationConsts.TokenCacheKey) as ExternalAuthToken;

    if (IsStillValid(cached?.AccessTokenExpiresAt))
        return cached;

    await _tokenLock.WaitAsync();
    try
    {
        cached = await cache.GetOrDefaultAsync(IntegrationConsts.TokenCacheKey) as ExternalAuthToken;
        if (IsStillValid(cached?.AccessTokenExpiresAt))
            return cached;

        ExternalAuthToken freshToken;
        if (IsStillValid(cached?.RefreshTokenExpiresAt))
        {
            try
            {
                freshToken = await RefreshAccessToken(cached.Result.RefreshToken);
                PreserveRefreshTokenIfMissing(freshToken, cached);
            }
            catch
            {
                freshToken = await GetAccessToken();
            }
        }
        else
        {
            freshToken = await GetAccessToken();
        }

        await SaveTokenToCache(freshToken);
        return freshToken;
    }
    finally
    {
        _tokenLock.Release();
    }
}

private static bool IsStillValid(DateTime? expiresAt)
    => expiresAt.HasValue && Clock.Now < expiresAt.Value;

private static DateTime CalculateExpiry(DateTime issuedAt, int lifetimeSeconds)
{
    var safeLifetime = Math.Max(lifetimeSeconds, 0);
    var buffer = Math.Min(TokenExpiryBufferSeconds, safeLifetime);
    return issuedAt.AddSeconds(safeLifetime - buffer);
}

private static void PreserveRefreshTokenIfMissing(ExternalAuthToken freshToken, ExternalAuthToken previousToken)
{
    if (freshToken?.Result == null || previousToken?.Result == null) return;

    if (string.IsNullOrWhiteSpace(freshToken.Result.RefreshToken))
    {
        freshToken.Result.RefreshToken = previousToken.Result.RefreshToken;
        freshToken.Result.RefreshTokenExpireInSeconds = previousToken.Result.RefreshTokenExpireInSeconds;
        freshToken.RefreshTokenExpiresAt = previousToken.RefreshTokenExpiresAt;
    }
}

private async Task SaveTokenToCache(ExternalAuthToken token)
{
    var cache = _cacheManager.GetCache(IntegrationConsts.TokenCacheName);
    var now = Clock.Now;
    token.AccessTokenExpiresAt = CalculateExpiry(now, token.Result?.ExpireInSeconds ?? 0);

    if (token.RefreshTokenExpiresAt == default)
        token.RefreshTokenExpiresAt = CalculateExpiry(now, token.Result?.RefreshTokenExpireInSeconds ?? 0);

    await cache.SetAsync(IntegrationConsts.TokenCacheKey, token, null, token.RefreshTokenExpiresAt);
}

}`