title: Spring security JWT refresh token not expiring
body: <p>i am new to spring and i'm working on spring boot REST with spring security and currently I implemented JWT token. I have some questions but can't seem to find an answer to them. I tried adding a refresh token.<br>
  At first i thought i will store it in database with user, but spring security does everything automatically and i can't seem to find how to store it at a given field of table user.<br>
  So, moving on i decided i will try sticking with spring security automation and I set refresh token expiration time to 10 seconds to test if it expires, but sadly it does not work as intended - I can use refresh token for as long as I want and generate new tokens with it.<br>
  So here I have a couple of questions:<br>
  1. How do i make refresh token expire after given time? Here's my security config  </p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
  @Value("${security.signing-key}")
  private String signingKey;
  
  @Value("${security.encoding-strength}")
  private Integer encodingStrength;
  
  @Value("${security.security-realm}")
  private String securityRealm;
  
  @Autowired
  private UserDetailsService userDetailsService;
  
  @Bean
  @Override
  protected AuthenticationManager authenticationManager() throws Exception {
      return super.authenticationManager();
  }
  
  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
      auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
  }
  
  @Bean
  public PasswordEncoder passwordEncoder() {
      PasswordEncoder encoder = new BCryptPasswordEncoder();
      return encoder;
  }
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and().httpBasic()
              .realmName(securityRealm).and().csrf().disable();
  
  }
  
  @Bean
  public JwtAccessTokenConverter accessTokenConverter() {
      JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
      converter.setSigningKey(signingKey);
      return converter;
  }
  
  @Bean
  public TokenStore tokenStore() {
      return new JwtTokenStore(accessTokenConverter());
  }
  
  @Bean
  @Primary
  public DefaultTokenServices tokenServices() {
      DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
      defaultTokenServices.setTokenStore(tokenStore());
      defaultTokenServices.setSupportRefreshToken(true);
      defaultTokenServices.setRefreshTokenValiditySeconds(10);
      return defaultTokenServices;
  }
  </code></pre>
  
  <p>}</p>
  
  <ol start="2">
  <li>Is it possible to pass refresh token to database and manually check if token is valid, because that was my first idea.</li>
  </ol>