As you know, there are some good reasons for using **token based authentication** instead of session based.

In session based, of course there is a expiration time. So if user is not active for a while, his session get expired. But before expiring, if he send request to server, his time will be extended.

There is an awesome tutorial [here](https://www.sitepoint.com/php-authorization-jwt-json-web-tokens/) about `JWT`. I have a question about **expiration time for token**. Imagine we set the expiration time to 100 seconds, then we sign the token. It doesn't matter user is active or not. After 100 seconds **that token will not be valid anymore**. This bothers the user. Is there any way to extend the time?

Is it a true approach, or maybe I have a mistake. Any idea?