title: How to properly handle a JWT refresh?
body: <p>I have an android app. It connects with a <code>REST API</code> developed with <code>Jersey</code>. My REST End points are secured with Tokens. Below is how I generate them.</p>
  
  <pre><code>Algorithm algorithm = Algorithm.HMAC256(secret);
  String token = JWT.create()
      .withClaim("userName","myusername)
      .withExpiresAt(expirationDate)
      .sign(algorithm);
  </code></pre>
  
  <p>Below is how I validate the token</p>
  
  <pre><code>public boolean validateTokenHMAC256(String token, String secret) throws UnsupportedEncodingException, JWTVerificationException
      {       
          Algorithm algorithm = Algorithm.HMAC256(secret);
  
  
          JWTVerifier verifier = JWT.require(algorithm) 
                  .build(); //Reusable verifier instance
              DecodedJWT jwt = verifier.verify(token);
  
              Claim usernameClaim = jwt.getClaim("username");
              String username = usernameClaim.asString();
              System.out.println(username);
  
  
          return true;
      }
  </code></pre>
  
  <p>In my REST API I have a filter and that filter checks every request to see whether the token is as it is. Below is the code.</p>
  
  <pre><code>@Secured
  @Provider
  @Priority(Priorities.AUTHENTICATION)
  public class AuthenticationFilter implements ContainerRequestFilter{
  
      //private static String authorizationSecret = "ZXW24xGr9Dqf9sq5Dp8ZAn5nSnuZwux2QxdvcH3wQGqYteJ5yMTw5T8DBUJPbySR";
  
      public AuthenticationFilter()
      {
          System.out.println("test printing");
      }
  
      @Override
      public void filter(ContainerRequestContext crc) throws IOException
      {
          String headerString = crc.getHeaderString("Bearer");
          System.out.println("bluh: "+headerString);
          System.out.println("test printing");
  
          try
          {
              boolean validateToken = validateToken(headerString, AuthKey.authorizationSecret);
              System.out.println("valid");
          }
          catch(Exception e)
          {
              System.out.println("invalid");
              crc.abortWith(
                  Response.status(Response.Status.UNAUTHORIZED).build());
          }
  
      }
  
      private boolean validateToken(String strToken, String secret) throws UnsupportedEncodingException, JWTVerificationException
      {
          Token token = new Token();
          return token.validateTokenHMAC256(strToken,secret);
      }
  
  
  
  }
  </code></pre>
  
  <p>The above code will be called when the user login to the application. However the token will be expired in 60 minutes. I know that after the token is expired either I have to take the user back to sign in screen or refresh the token. I went through the advices in <a href="https://stackoverflow.com/a/42975148/1379286">here</a> and <a href="https://stackoverflow.com/a/26778123/1379286">here</a></p>
  
  <p>But I do not understand the following.</p>
  
  <ol>
  <li><p>How can I figure out whether the token has to be renewed? I thought I should do that after it is expired, but seems that is not the case. If I ask it to refresh in <code>now&lt;exp</code> it will refresh in every request.</p></li>
  <li><p>How can I assign and send this token back to the user? Currently when the user login on, he will get the token and he will save it in a variable. For the refreshed token to work, do I have to call the <code>login</code> method again (So the token will be sent to the user) or JWT it self will handle the case?</p></li>
  <li><p>How do I actually refersh using <a href="https://github.com/auth0/java-jwt" rel="noreferrer">java-jwt</a> ?</p></li>
  </ol>