{"action":"opened","issue":{"url":"https://api.github.com/repos/bryanjos/joken/issues/31","labels_url":"https://api.github.com/repos/bryanjos/joken/issues/31/labels{/name}","comments_url":"https://api.github.com/repos/bryanjos/joken/issues/31/comments","events_url":"https://api.github.com/repos/bryanjos/joken/issues/31/events","html_url":"https://github.com/bryanjos/joken/issues/31","id":76555341,"number":31,"title":"[Feature request] - Check expired token for refreshing it","user":{"login":"cs-victor-nascimento","id":7049728,"avatar_url":"https://avatars.githubusercontent.com/u/7049728?v=3","gravatar_id":"","url":"https://api.github.com/users/cs-victor-nascimento","html_url":"https://github.com/cs-victor-nascimento","followers_url":"https://api.github.com/users/cs-victor-nascimento/followers","following_url":"https://api.github.com/users/cs-victor-nascimento/following{/other_user}","gists_url":"https://api.github.com/users/cs-victor-nascimento/gists{/gist_id}","starred_url":"https://api.github.com/users/cs-victor-nascimento/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cs-victor-nascimento/subscriptions","organizations_url":"https://api.github.com/users/cs-victor-nascimento/orgs","repos_url":"https://api.github.com/users/cs-victor-nascimento/repos","events_url":"https://api.github.com/users/cs-victor-nascimento/events{/privacy}","received_events_url":"https://api.github.com/users/cs-victor-nascimento/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-05-15T01:58:42Z","updated_at":"2015-05-15T01:58:42Z","closed_at":null,"body":"It is common the need for refreshing a JWT token. Once an issued token expires the client should be able to renew it with some mechanism. Refreshing is not Joken's purpose but in this scenario we need to check the validity of a token even if it has expired. \r\n\r\nThe issue is that decoding a token with Joken will give an error in the first claim (exp) that will be piped through all other claims without checking. So, it would be nice to have a way to decode a token and know that all claims BUT exp are valid and refreshing can proceed.\r\n\r\nThis is perhaps a new function in Joken module that would delegate to Joken.Token.decode with some kind of option. Something like:\r\n\r\n```elixir\r\n# this enforces the caller to know the token may be expired\r\n{:expired, payload} = Joken.decode_expired some_jwt\r\n```\r\n\r\nOr maybe some optional parameter to Joken.decode like:\r\n\r\n```elixir\r\n# optional skip parameter at call site that shows the caller knows what he is doing\r\n{:ok, payload} = Joken.decode some_jwt, skip: [:exp]\r\n```\r\nPersonally, I prefer the second option but that is debatable. If desired I can come up with a PR for these options."}}