@ Override protected Map < String , Object > decode ( String token ) { try { //check if our public key and thus SignatureVerifier have expired long ttl = oAuth2Properties . getSignatureVerification ( ) . getTtl ( ) ; if ( ttl > 0 && System . currentTimeMillis ( ) - lastKeyFetchTimestamp > ttl ) { throw new InvalidTokenException ( "public key expired" ) ; } return super . decode ( token ) ; } catch ( InvalidTokenException ex ) { if ( tryCreateSignatureVerifier ( ) ) { return super . decode ( token ) ; } throw ex ; } }
Try to decode the token with the current public key . If it fails contact the OAuth2 server to get a new public key then try again . We might not have fetched it in the first place or it might have changed .