refresh token flow

[donakhseputa]

How to implement refresh token like this:

1. when login return access_token and refresh_token
2. when access_token expires, return a message that informs the token was expired.
3. after expired, request a new token by sending refresh_token
4. then return new access_token with new refresh_token too.

I'm using lumen 8 and from your documentation, the AuthController only return access_token how to generate refresh_token with TTL_REFRESH ?

[hmshohrab]

same questions......

[ayb-cha]

same ....

[dmitriymikheev]

Same)

[okyaneka]

i think its similar with oauth2

[hamakh11]

same :(

[Renison-Gohel]

Same here

[pasanjg]

Any solution to this?

[huda16]

How to implement refresh token like this:

1. when login return access_token and refresh_token
2. when access_token expires, return a message that informs the token was expired.
3. after expired, request a new token by sending refresh_token
4. then return new access_token with new refresh_token too.

I'm using lumen 8 and from your documentation, the AuthController only return access_token how to generate refresh_token with TTL_REFRESH ?

I think you can't implement a refresh token like that, but like this:

1. When login return access_token
2. When access_token expires, return a message that informs the token was expired.
3. After expiration, request a new token by sending the previous access_token to auth()->refresh(true, true).
4. Then return the new access_token and the previous access_token has been blacklisted.

[iqbalatma]

How to implement refresh token like this:

1. when login return access_token and refresh_token
2. when access_token expires, return a message that informs the token was expired.
3. after expired, request a new token by sending refresh_token
4. then return new access_token with new refresh_token too.

I'm using lumen 8 and from your documentation, the AuthController only return access_token how to generate refresh_token with TTL_REFRESH ?

Actually, i also had same issue. have you already found the solution ?

[hamakh11]

@okyaneka I stopped using this package because I didn't find a way to achieve the above, so I used Laravel passport to make it.

[eznix86]

The tymondesigns/jwt-auth access token has an hybrid behavior. It can be used as a refresh token and as an access token. Once it has passed the expiration time in minutes, It will be invalid as an access token but it will still be valid as a refresh token. When the token is refreshed, the token sent is invalidated (means you cannot use it anymore) and a new token is returned.

Endpoint which has a refresh behavoir should not be using the middleware 'auth:api'. Example:

$this->middleware('auth:api')->except(['refresh']);

or do not include it in a group route middleware.