The 'iat' is not refreshed in refresh() method, which cause the user will eventually kicked out though he keep refreshing token.

[amos-yau]

Subject of the issue

Please refer to the issue and comment in the origin repository here:
tymondesigns/jwt-auth#2241 (comment)

Your environment:

Q	A
Bug?	yes
New Feature?	no
Framework	Laravel
Framework version	v10.48.10
Package version	2.3.0
PHP version	8.3.6

Steps to reproduce

Scenario and steps is in the above issue url.

Expected behaviour

The new token 'iat' generated by refresh() method shall be renewed as now().

Actual behaviour

The new token 'iat' generated by refresh() method now is fixed the same as old token.

[mfn]

Can you make a PR to look at?

[amos-yau]

no problem, the change is easy just 2 lines of code only.

[mfn]

Don't forget the tests 😅

[amos-yau]

I'm new to Laravel so this takes me more time to write and run test, meanwhile if anyone is interested, could first can take a look to the code change here

[lsfiege]

Hi! I'm experiencing this exact issue and the code change suggested by @amos-yau is working. Let me check if I can send a PR.

For context: To replicate this issue, I opened multiple tabs of the same application in my browser. I let the app send periodic requests (such as using setTimeout) and waited for the refresh token flow. At first, I thought that enabling the grace period would be sufficient, but it didn't work because the users were still getting kicked out, until I found this issue, implemented the change in the vendor file, and checked this works.

[Messhias]

I'm new to Laravel so this takes me more time to write and run test, meanwhile if anyone is interested, could first can take a look to the code change here

If you want to can open the pull request and add the tests too.

[lsfiege]

PR opened :) #256