...
- ✅ Valid token → Request proceeds to controller
- ❌ Invalid token → Return 401 Unauthorized
...
Step 7: API Processes Request
What happens:
- Request validated successfully
- IntegrationServiceAPI processes the request
- Executes the requested operation
- Returns response to ApiService
Who's involved:
- IntegrationServiceAPI
- ApiService
Result:
- Operation completed
- Response returned to ApiService
- ApiService continues its workflow
...
Token Caching & Reuse
Token Caching
ServiceTokenHandler caches tokens to improve performance:
First request:
- No cached token available
- Request token from Azure AD (takes ~100-200ms)
- Cache token for 1 hour
- Use token for request
Subsequent requests (within 1 hour):
- Check cache for valid token
- Use cached token (takes ~1-5ms)
- No Azure AD call needed
After 1 hour:
- Cached token expired
- Request new token from Azure AD
- Update cache with new token
Benefits:
- ⚡ Fast (no Azure AD call for most requests)
- 📈 Scalable (no rate limits on cached tokens)
- 🔒 Secure (token automatically refreshed)
...
Security Details
Client Secret
What it is:
- A secret key that proves ApiService's identity
- Like a password for the application (not a user)
- Created in Azure AD app registration
- Must be kept secure
Where it's stored:
- Development: User secrets or
secrets.json
...
- Production:
...
- Use environment variables (or in Key Vault
...
- )
- Never: Committed to source control
How it's used:
- ServiceTokenHandler reads it from configuration
- Sends it to Azure AD with client ID
- Azure AD validates it matches the registered secret
- If valid, token is issued
Security best practices:
- ✅
...
- Use environment variables (or in
...
- Key Vault
...
- )
...
- ✅ Rotate periodically (every 6-12 months)
- ❌ Never commit to git
- ❌ Never hardcode in source files