title: I don't understand JWT refresh token's behaviour (LARAVEL)
body: <p>I have just tried JWT auth with LARAVEL and this <a href="https://github.com/tymondesigns/jwt-auth" rel="noreferrer">https://github.com/tymondesigns/jwt-auth</a></p>
  
  <p>But there's something i can't understand. In their config they put : </p>
  
  <pre><code>'ttl' =&gt; env('JWT_TTL', 60), // in munutes
  'refresh_ttl' =&gt; env('JWT_REFRESH_TTL', 20160), // in minutes
  </code></pre>
  
  <p>What i understant : the token's live is 1hour and can be refreshed within 2 weeks</p>
  
  <p>But after 3hours, if i try to query something, it says "token expired".</p>
  
  <p>Does this system mean, a user must get his token updated / refreshed within every hour but with a limit of 2 weeks ? I don't get it.</p>
  
  <p>How can a user persist login with this kind of system ? How is the refresh Token useful when after the first hour, though it hasn't been 2 weeks yet, i can't get a fresh token ?</p>
  
  <p>thanks</p>
  
  <p>UPDATE: CODE</p>
  
  <p>config/jwt.php</p>
  
  <pre><code>'ttl' =&gt; 2, // 2 minutes
  'refresh_ttl' =&gt; 5, // 5 minutes
  </code></pre>
  
  <p>routes/api.php</p>
  
  <pre><code>Route::post('/login', 'AuthController@login');
  Route::get('/test', 'AuthController@test')-&gt;middleware('jwt.auth', 'jwt.refresh');
  </code></pre>
  
  <p>Http/Controllers/AuthController</p>
  
  <pre><code>namespace App\Http\Controllers;
  
  use Illuminate\Http\Request;
  use JWTAuth;
  use Tymon\JWTAuth\Exceptions\JWTException;
  
  class AuthController extends Controller
  {
      public function test()
      {
          return response()-&gt;json(['coucou' =&gt; 1]);
      }
  
      public function login(Request $request)
      {
          // grab credentials from the request
          $credentials = $request-&gt;only('email', 'password');
  
          try {
              // attempt to verify the credentials and create a token for the user
              if (! $token = JWTAuth::attempt($credentials)) {
                  return response()-&gt;json(['error' =&gt; 'invalid_credentials'], 401);
              }
          } catch (JWTException $e) {
              // something went wrong whilst attempting to encode the token
              return response()-&gt;json(['error' =&gt; 'could_not_create_token'], 500);
          }
  
          // all good so return the token
          return response()-&gt;json(compact('token'));
      }
  }
  </code></pre>
  
  <p>AND THIS IS THE FLOW : </p>
  
  <p><strong>request</strong> to <strong>/login</strong> with {username: xxx, password: xxx}
  <strong>response</strong> of <strong>/login</strong> > {token: xxxxxxx}</p>
  
  <p><strong>request</strong> to <strong>/test</strong> straight after (10 secs) with <strong>Bearer xxxxxx</strong>
  <strong>response</strong> of <strong>/test</strong> > the good json response with NEW TOKEN in HEADER</p>
  
  <p><strong>request</strong> to <strong>/test</strong> after 3 minutes (so 3mins 10 secs have past now, less than the 5min of refresh limit)
  <strong>response</strong> of <strong>/test</strong> > token expired</p>
  
  <p>I don't understand.</p>