第二次刷新后，JWT-TOKEN_EXPIRED

Question

I am developing an API server with laravel and tymon/jwt-auth . In the test envirovment TTL - 1 min, TTL_REFRESH - 2 min. Don't understand how the following algoritm works:

1. The user logged in and received a token
2. TTL of the token is expired, but TTL_REFRESH is not. User sends a request to the server to refresh the token
3. The user uses a new token, but has not updated it in time. Token is expired again.
4. When user trying to refresh the token at second time (first time was at 2 step), server sends TOKEN_EXPIRED

If after 1 and 2 steps try to refresh the token with not-expired TTL, token will be refreshed. But if we refresh it once after expired, after second time (with expired token) server will send to client TOKEN_EXPIRED .

My question is why after the second token update with expired TTL, server not refreshes the token but send TOKEN_EXPIRED ?

Answer 1

I think refresh token has been invalidate after first use

you must use new refresh token to refresh your jwt token and get new one