1.Implementing api authentication using tymondesigns/jwt-auth in a Laravel 8.x project. Testing the login and protected routes with access_token stored in cookies and implemented an autorefresh middleware if the token expired.To test it put the ttl to 2 minutes and refresh_ttl to 5 minutes.But when i refresh the token after 3 minutes assuming the refresh_ttl also gets updated&prolonged, after 2 minutes i can't refresh it,gives TokenExpiredException .Is it the expected behavior? What if a user having activity and suddenly the refresh_ttl expires and gets redirected to login?
2.All other similar threads mention the use of explicit refresh_token(if i understand correctly) but according to jwt-auth docs
$refreshed = JWTAuth::refresh(JWTAuth::getToken());
it uses the old token even if it expired already and not any other extra $refresh_token value (maybe under the hood don't know).But where is it?