{"action":"created","issue":{"url":"https://api.github.com/repos/GetBlimp/django-rest-framework-jwt/issues/92","labels_url":"https://api.github.com/repos/GetBlimp/django-rest-framework-jwt/issues/92/labels{/name}","comments_url":"https://api.github.com/repos/GetBlimp/django-rest-framework-jwt/issues/92/comments","events_url":"https://api.github.com/repos/GetBlimp/django-rest-framework-jwt/issues/92/events","html_url":"https://github.com/GetBlimp/django-rest-framework-jwt/issues/92","id":65731766,"number":92,"title":"Tokens won't refresh after expiration date despite high refresh expiration delta","user":{"login":"MasterKale","id":5166470,"avatar_url":"https://avatars.githubusercontent.com/u/5166470?v=3","gravatar_id":"","url":"https://api.github.com/users/MasterKale","html_url":"https://github.com/MasterKale","followers_url":"https://api.github.com/users/MasterKale/followers","following_url":"https://api.github.com/users/MasterKale/following{/other_user}","gists_url":"https://api.github.com/users/MasterKale/gists{/gist_id}","starred_url":"https://api.github.com/users/MasterKale/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MasterKale/subscriptions","organizations_url":"https://api.github.com/users/MasterKale/orgs","repos_url":"https://api.github.com/users/MasterKale/repos","events_url":"https://api.github.com/users/MasterKale/events{/privacy}","received_events_url":"https://api.github.com/users/MasterKale/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2015-04-01T17:01:30Z","updated_at":"2015-10-05T01:33:09Z","closed_at":null,"body":"I've implemented `rest_framework_jwt` and have it working for authentication when accessing my API. However, I'm unable to refresh any tokens if it's after the token's `exp` value despite setting `JWT_REFRESH_EXPIRATION_DELTA` to 30 days.\r\n\r\nFor example, if I have the following settings...\r\n\r\n    JWT_AUTH = {\r\n        'JWT_EXPIRATION_DELTA': datetime.timedelta(seconds=900),\r\n        'JWT_ALLOW_REFRESH': True,\r\n        'JWT_REFRESH_EXPIRATION_DELTA': datetime.timedelta(days=30),\r\n    }\r\n\r\n...then shouldn't I be able to refresh the token within 30 days of the token's `orig_iat` date? Am I misreading the [settings documentation](http://getblimp.github.io/django-rest-framework-jwt/#additional-settings) for `JWT_REFRESH_EXPIRATION_DELTA`?\r\n\r\nOut of curiosity I dug into PyJWT and found out that its `decode()` function only checks that the expiration date is later than `utcnow()+leeway`:\r\n\r\n\tif 'exp' in payload and verify_expiration:\r\n\t    utc_timestamp = timegm(datetime.utcnow().utctimetuple())\r\n\r\n\t    if payload['exp'] < (utc_timestamp - leeway):\r\n\t        raise ExpiredSignatureError('Signature has expired')\r\n\r\nGoing back into `RefreshJSONWebTokenSerializer` reveals that the token isn't getting past the initial payload check (which calls PyJWT's `decode()` function) to determine if the current time is within `orig_iat + RefreshJSONWebTokenSerializer`.\r\n\r\nIs this just a huge misunderstanding on my part as to how JWTs work?"},"comment":{"url":"https://api.github.com/repos/GetBlimp/django-rest-framework-jwt/issues/comments/145408899","html_url":"https://github.com/GetBlimp/django-rest-framework-jwt/issues/92#issuecomment-145408899","issue_url":"https://api.github.com/repos/GetBlimp/django-rest-framework-jwt/issues/92","id":145408899,"user":{"login":"ajostergaard","id":791747,"avatar_url":"https://avatars.githubusercontent.com/u/791747?v=3","gravatar_id":"","url":"https://api.github.com/users/ajostergaard","html_url":"https://github.com/ajostergaard","followers_url":"https://api.github.com/users/ajostergaard/followers","following_url":"https://api.github.com/users/ajostergaard/following{/other_user}","gists_url":"https://api.github.com/users/ajostergaard/gists{/gist_id}","starred_url":"https://api.github.com/users/ajostergaard/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ajostergaard/subscriptions","organizations_url":"https://api.github.com/users/ajostergaard/orgs","repos_url":"https://api.github.com/users/ajostergaard/repos","events_url":"https://api.github.com/users/ajostergaard/events{/privacy}","received_events_url":"https://api.github.com/users/ajostergaard/received_events","type":"User","site_admin":false},"created_at":"2015-10-05T01:33:09Z","updated_at":"2015-10-05T01:33:09Z","body":"The docs are actually pretty clear: http://getblimp.github.io/django-rest-framework-jwt/#refresh-token\r\n\r\nThe refresh expiration delta allows you to continue refreshing tokens as long as you do so while you still have an unexpired token.\r\n\r\nWorks as intended."}}