Handling AuthenticationFailureResult on client side - asp.net-web-api

Question

I am using pretty much this approach to secure our api with tokens. Not sure, how to handle token expiry response on client side. I have seen two options on api side -
Challenge
WWW-Authenticate header
Let's say my client is requesting for contacts list but their token is expired as it was issued 30 mins ago (our current token age). What do we do now?
Not a good experience if we ask for credentials again
use a do-while loop until we have a successful response. Our client is a plugin so we can store user's credentials in db.
try\catch could be a possibility too
Implementing IdentityServer and refresh tokens would be a overkill for us at this point.

Answer 1

There are several ways you can deal this getting new tokens after they expire. Its not a good experience asking for credentials every time the token expires. Some of the ways to achieve this is to use MemoryCache or text file to store your token then keep reading from it. Once the token expires get a new one and replace the one you stored earlier. Sample code below
public async Task<string> GetToken(HttpClient client)
{
Token token;
MemoryCache memCache = MemoryCache.Default;
var resource = memCache.Get(Settings.TokenKey);
if (resource.IsNotNull())
{
token = (Token)resource;
if (token != null && token.Expires < DateTime.Now)
{
token = await RequestNewToken(client);
return token.AccessToken;
}
}
token = await RequestNewToken(client);
return token.AccessToken;
}
private async Task<Token> RequestNewToken(HttpClient client)
{
var tokenRequestContent = GetTokenRequestContent();
var tokenResponse = client.PostAsync(Settings.TokenUrl, tokenRequestContent).Result;
Token token = null;
MemoryCache memCache = MemoryCache.Default;
if (tokenResponse.IsSuccessStatusCode)
{
token = await tokenResponse.Content.ReadAsAsync<Token>();
memCache.Add(Settings.TokenKey, token, DateTimeOffset.UtcNow.AddHours(2));
}
else
{
var error = await tokenResponse.Content.ReadAsStringAsync();
Console.WriteLine(error);
}
if (token == null) throw new NullReferenceException("Token is null");
return token;
}
private FormUrlEncodedContent GetTokenRequestContent()
{
var credentials = new List<KeyValuePair<string, string>>
{
new KeyValuePair<string, string>("grant_type", Settings.Password),
new KeyValuePair<string, string>("userName", Settings.Username),
new KeyValuePair<string, string>("password", Settings.UserPassword)
};
return new FormUrlEncodedContent(credentials);
}
Settings is just a static class that holds your constants.