{"action":"created","issue":{"url":"https://api.github.com/repos/tymondesigns/jwt-auth/issues/201","labels_url":"https://api.github.com/repos/tymondesigns/jwt-auth/issues/201/labels{/name}","comments_url":"https://api.github.com/repos/tymondesigns/jwt-auth/issues/201/comments","events_url":"https://api.github.com/repos/tymondesigns/jwt-auth/issues/201/events","html_url":"https://github.com/tymondesigns/jwt-auth/issues/201","id":98616955,"number":201,"title":"Refreshed token `exp` can be older than `iat` + refresh_ttl - that would force the user to login again in some cases","user":{"login":"dani3l","id":1437502,"avatar_url":"https://avatars.githubusercontent.com/u/1437502?v=3","gravatar_id":"","url":"https://api.github.com/users/dani3l","html_url":"https://github.com/dani3l","followers_url":"https://api.github.com/users/dani3l/followers","following_url":"https://api.github.com/users/dani3l/following{/other_user}","gists_url":"https://api.github.com/users/dani3l/gists{/gist_id}","starred_url":"https://api.github.com/users/dani3l/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dani3l/subscriptions","organizations_url":"https://api.github.com/users/dani3l/orgs","repos_url":"https://api.github.com/users/dani3l/repos","events_url":"https://api.github.com/users/dani3l/events{/privacy}","received_events_url":"https://api.github.com/users/dani3l/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-08-02T15:32:51Z","updated_at":"2015-08-17T22:05:31Z","closed_at":null,"body":"Hi \r\nI noticed that `exp` timestamp can be older than `iat` + refresh_ttl\r\nLet's say the user haven't logged in two weeks-1min and tries to refresh the token\r\ntoken is being refreshed, but the next time he tries to refresh it, it would throw a TokenInvalid since the `iat` timestamp is not renewed.\r\n\r\nIs there something I'm missing or should I implement this use case myself?  (check for iat + refresh_ttl and generate an entirely new token if needed)\r\nthanks!"},"comment":{"url":"https://api.github.com/repos/tymondesigns/jwt-auth/issues/comments/131978407","html_url":"https://github.com/tymondesigns/jwt-auth/issues/201#issuecomment-131978407","issue_url":"https://api.github.com/repos/tymondesigns/jwt-auth/issues/201","id":131978407,"user":{"login":"tdhsmith","id":1791252,"avatar_url":"https://avatars.githubusercontent.com/u/1791252?v=3","gravatar_id":"","url":"https://api.github.com/users/tdhsmith","html_url":"https://github.com/tdhsmith","followers_url":"https://api.github.com/users/tdhsmith/followers","following_url":"https://api.github.com/users/tdhsmith/following{/other_user}","gists_url":"https://api.github.com/users/tdhsmith/gists{/gist_id}","starred_url":"https://api.github.com/users/tdhsmith/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tdhsmith/subscriptions","organizations_url":"https://api.github.com/users/tdhsmith/orgs","repos_url":"https://api.github.com/users/tdhsmith/repos","events_url":"https://api.github.com/users/tdhsmith/events{/privacy}","received_events_url":"https://api.github.com/users/tdhsmith/received_events","type":"User","site_admin":false},"created_at":"2015-08-17T22:05:31Z","updated_at":"2015-08-17T22:05:31Z","body":"Isn't this the intended functionality? We set the window of time (`refresh_ttl`) from an initial login (`iat`) that a user can refresh *within*, not the time from the last refresh. Otherwise the user could chain refreshes forever and never revalidate their credentials.\r\n\r\nMaybe there is a use-case for this but I prefer the current form, because otherwise I would have to manually force a user to log out periodically (or risk exposing a huge attack surface; an attacker merely has to refresh every once in a while and they have a perma-token)."}}