{"action":"created","issue":{"url":"https://api.github.com/repos/jpadilla/ember-cli-simple-auth-token/issues/43","labels_url":"https://api.github.com/repos/jpadilla/ember-cli-simple-auth-token/issues/43/labels{/name}","comments_url":"https://api.github.com/repos/jpadilla/ember-cli-simple-auth-token/issues/43/comments","events_url":"https://api.github.com/repos/jpadilla/ember-cli-simple-auth-token/issues/43/events","html_url":"https://github.com/jpadilla/ember-cli-simple-auth-token/issues/43","id":67439250,"number":43,"title":"Keep me logged in functionality","user":{"login":"calvinmetcalf","id":1128607,"avatar_url":"https://avatars.githubusercontent.com/u/1128607?v=3","gravatar_id":"","url":"https://api.github.com/users/calvinmetcalf","html_url":"https://github.com/calvinmetcalf","followers_url":"https://api.github.com/users/calvinmetcalf/followers","following_url":"https://api.github.com/users/calvinmetcalf/following{/other_user}","gists_url":"https://api.github.com/users/calvinmetcalf/gists{/gist_id}","starred_url":"https://api.github.com/users/calvinmetcalf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/calvinmetcalf/subscriptions","organizations_url":"https://api.github.com/users/calvinmetcalf/orgs","repos_url":"https://api.github.com/users/calvinmetcalf/repos","events_url":"https://api.github.com/users/calvinmetcalf/events{/privacy}","received_events_url":"https://api.github.com/users/calvinmetcalf/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-04-09T19:59:12Z","updated_at":"2015-05-15T13:34:53Z","closed_at":null,"body":"Currently you have a choice between having a long refresh interval on the tokens but having no way to update information on the token or you can have a short refresh interval but then the user has to login again frequently.  I had an idea for a way to get the best of both:\r\n\r\nOn login with credentials instead of getting a single token you'd get 2, one would be the same as the current set up, it would have a short expiration but have an audience value that made it valid for making requests on the site but not valid for refreshing. The other token would have a much longer expiration but would have an audience that make it only valid for being used to refresh tokens to get new ones. \r\n\r\nI.E. the short token could be valid for an hour and the long one for 2 weeks.  But that means that if you deleted a user they would still be able to login for another hour but even though they have a valid long token they wouldn't be able to trade it in to get a new short token.\r\n\r\nThoughts?"},"comment":{"url":"https://api.github.com/repos/jpadilla/ember-cli-simple-auth-token/issues/comments/102398572","html_url":"https://github.com/jpadilla/ember-cli-simple-auth-token/issues/43#issuecomment-102398572","issue_url":"https://api.github.com/repos/jpadilla/ember-cli-simple-auth-token/issues/43","id":102398572,"user":{"login":"quiddle","id":976237,"avatar_url":"https://avatars.githubusercontent.com/u/976237?v=3","gravatar_id":"","url":"https://api.github.com/users/quiddle","html_url":"https://github.com/quiddle","followers_url":"https://api.github.com/users/quiddle/followers","following_url":"https://api.github.com/users/quiddle/following{/other_user}","gists_url":"https://api.github.com/users/quiddle/gists{/gist_id}","starred_url":"https://api.github.com/users/quiddle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/quiddle/subscriptions","organizations_url":"https://api.github.com/users/quiddle/orgs","repos_url":"https://api.github.com/users/quiddle/repos","events_url":"https://api.github.com/users/quiddle/events{/privacy}","received_events_url":"https://api.github.com/users/quiddle/received_events","type":"User","site_admin":false},"created_at":"2015-05-15T13:34:53Z","updated_at":"2015-05-15T13:34:53Z","body":"I'll add that another benefit of using JWT is that the token can contain pertinent information to the client application. The `sub` field might contain the `user_id` that is then used to access a specific page. It also might contain scopes that indicate what access rights a token has. This could be used application side to reveal admin features."}}