During each Http Request incoming from my Angular front-end I send encrypted pair of access & refresh token. On the back end an ASP.NET Web APIs are used. The way I decrypt them currently is by creating 2 custom middlewares in one of the APIs(one after another): The first one decrypt the access token, modifies the http request header with the decrypted information and passes it to the next middleware. The second one checks if the (decrypted) access token is expired and depending on this - issues new access token, using the (decrypted) refresh token and again modifies the Http header with the new access token.

Here is my implementation: 1st middleware:

 public async Task InvokeAsync(HttpContext context)
        {
            string decryptedAccessToken = await tokenService.DecryptToken(context);

            if (string.IsNullOrEmpty(decryptedAccessToken))
            {
                await _next(context);
                return;
            }

            context.Request.Headers.Remove("Authorization");
            context.Request.Headers.Add("Authorization", "Bearer " + decryptedAccessToken);

            await _next(context);
        }

2nd middleware:

public async Task InvokeAsync(HttpContext context)
        {
            var tokenExpirationString = await tokenService.ExtractTokenClaimValue(context, ExpirationClaimName);
            var tokenExpirationValue = 0l;

            if (string.IsNullOrWhiteSpace(tokenExpirationString) || !long.TryParse(tokenExpirationString, out tokenExpirationValue))
            {
                await _next(context);
                return;
            }

            var tokenExpirationTime = DateTimeOffset.FromUnixTimeSeconds(tokenExpirationValue).LocalDateTime;
            var currentTime = DateTime.Now;
            
            if (tokenExpirationTime <= currentTime)
            {
                await tokenService.GetNewAccessToken(context);
                await _next(context);
                return;
            }

            await _next(context);
        }

I issue my tokens using Identity Server. My question is - is this methodology of mine good practice or not? And can you recommend any better implementations?