For me it also make sens, because if i get a 401 as return the communication between client and server is over for this request.
Not sure The request failing because of 401 and the new request are separate HTTP requests.
I am now trying another option. Since I always query whether the user is currently authenticated when starting the app or switching the page (this is frequently), I also include the Access_Token_Expires_In and check whether it has expired or expires in less then five minutes. If so, I use the code of the article to update with the refresh token.
Can you briefly confirm that this process makes sense and has no security vulnerability?
Inspecting the access token on the client side is not a good practice. More than for security reasons, it’s for compliance reasons. See here.