How to delegate the refresh token renewal in a SOA

Question

So, we've got SOA on the backend (BE) and on the frontend (FE) we've got micro-frontends (the separate micro-frontends are loaded as components into the frontend app when needed, so internal process calls between them are possible, unlike the backend services, where between-process calls must be done).

On the BE we've got an Auth service and some other Bananas service. On the FE we've got also an auth micro-frontend and whatever other bananas micro-frontend. Imagine a user's access token has expired and he makes a request to /bananas/create. Each of our BE services of course validates the access token received on each request, and if invalid - return 401. We want to implement refresh token functionality (the refresh token will be passed alongside the access token with each request).

Now the question is: if a request with an expired token is received:

1. should the Bananas service, when seeing the token is expired, make a call to the Auth service to validate the refresh token and receive a new pair of tokens, then perform the actual bananas business and respond with the token pairs + the actual bananas data. All in 1 call. Or...
2. should the Bananas still return 401, then the bananas micro-frontend delegates to the auth micro-frontend to call the Auth service for new tokens, then return it to the bananas micro-frontend and it to make a new call to the Bananas service, with valid tokens?

This is the dilemma of design between me an my colleague. My point is that I don't want to have a 3 request-response calls back-and-forth. He argues that the Bananas service should always only return bananas data in its response objects, and not have cases when it also returns token pairs.

As I see it, both our points are valid, but we do not have the experience and knowledge to decide which has bigger priority/which is the better design.

Answer 1

2.

The front end owns the auth, so the front end should manage it. Personally, I would have some thin front end layer that orchestrates the components (and handles the user/authentication/authorization needed by all of them). But your colleague is right that APIs should return the same data types for every call. Request/response/request will happen from time to time for this (and optimistic concurrency if applicable; and transient network sort of error retry) and can be mitigated by refreshing the token slightly ahead of time.