title: JSON Web Token expiration and remember me functionality
body: <p>I am starting to work on an authentication system for an angular 2 Single Page Application using django-rest framework as back-end. I'd also like to have some kind of "remember me" functionality that is going to keep users logged in for a certain amount of time.</p>
  
  <p>From what I have read so far, it seems that the best authentication method for this kind of Angular 2 SPA/REST API is using jwt (json web token). For jwt authentication, I looked at the django-rest-framework-jwt (<a href="https://github.com/GetBlimp/django-rest-framework-jwt" rel="nofollow noreferrer">https://github.com/GetBlimp/django-rest-framework-jwt</a>). </p>
  
  <p>The <strong>problem</strong> that I see is that the token needs to have a short life span (few minutes to a few hours...) in order to minimize security issues if the token get stolen. The token now needs to be refreshed frequently to avoid the user from being disconnected while using the application. In this case, a "remember me" functionality is posing problem since the token have a short life span.</p>
  
  <p>I thought about a <strong>solution</strong> involving a second token that would serve as a refresh token. It would be opaque, have a longer life span and would contain information specific to the user (ip address or something like that) so that if it get stolen, the information specific to the user being different would render this refresh token invalid. 
  <br>
  <br></p>
  
  <p>So here are my <strong>questions</strong>:  </p>
  
  <p>1- I would like to know if they are existing solutions addressing this problem. As any security/authentication issues, I prefer to rely on well tested solutions to avoid getting my API compromised.<br>
  2- Would the refresh token based on specific user infos be a good idea?<br>
  3- Any other ideas how I could implement what I want?</p>