How to handle API calls when session expires?

Question

I'm accessing an API where you authorize first, and you get an access token back, which you use in successive calls. At some point (hours later), the access token expires. So I'm caching the token on the server so any users using the web app will initiate API calls using that token.

But when it expires, I do a recursive call after updating the access token. So, for example (in pseudo-JS):

function getDetails (id) {
  data = HTTP.get(url, {params: ...});

  if (!data.success) {
    updateToken(function () {
      return getDetails(id);
    });
  } else { /*.. we're good*/ }
}

There would also be a recursion depth check in there too. If there's a better way to do this, I'd love to hear it. Basically:

1. Call API
2. (failure)
3. Update token
4. Call API again

Answer 1

That is exactly how I set it up. However, if you have access to promises (e.g., bluebird or babel.js), it becomes even nicer syntactically. Here's your code rewritten with promises and es6:

function getDetails (id) {
    // the return is optional; return the promise if you want to chain to `getDetails`
    return HTTP.get(URL, id, params)
    .catch((err) => {
        if (err.VALIDATION_ERROR) {
            return updateToken().then(() => HTTP.get(URL, id, params))
        } else {
            throw err
        }
    }).then((yourRequest) => {
        // data here
    }).catch((err) => {
        // handle fatal error
    })
}

Answer 2

The best way would be to keep a timer, since you know how long the session lasts for. That was you can preemptively ask for a new token before your current token/session expires. Using this method also ensures that you never have an interruption of service (unless your request for a new token fails of course). Other than that, you seem to have the rest.

Of course, you will still need to implement the code you have shown us to deal with unexpected session expiration (maybe the API owners decide to invalidate all sessions because of a data breach, etc).