title: Why my jwt tokens never expire?
body: <p>I've inherited a Symfony project that uses this controller to authenticate users:</p>
  
  <pre><code>class TokenController extends FOSRestController
  {
      public function postTokensAction(Request $request)
      {
          $username = $request-&gt;request-&gt;get('username');
          $password = $request-&gt;request-&gt;get('password');
  
          $user = $this-&gt;get('fos_user.user_manager')
                       -&gt;findUserByUsername($username);
  
          if (!$user) {
              throw $this-&gt;createNotFoundException();
          }
  
          $passwordEncoder = $this-&gt;get('security.password_encoder');
          if(!$passwordEncoder-&gt;isPasswordValid($user, $password)) {
              throw $this-&gt;createAccessDeniedException();
          }
  
          $groups = ['foo', 'bar'];
          $context = SerializationContext::create()
                         -&gt;setGroups($groups);
  
          $token = $this-&gt;get('lexik_jwt_authentication.encoder')
                        -&gt;encode(['username' =&gt; $user-&gt;getUsername()]);
  
          $user = $this-&gt;get('jms_serializer')
                       -&gt;toArray($user, $context);
  
          return new JsonResponse([
              'token' =&gt; $token,
              'user' =&gt; $user
          ]);
      }
  }
  </code></pre>
  
  <p>And the customer requests an update: token should expire 10 seconds after the login. So, following the documentation, I added this listener.</p>
  
  <pre><code>&lt;?php
  
  namespace AppBundle\EventListener;
  
  use Lexik\Bundle\JWTAuthenticationBundle\Event\JWTCreatedEvent;
  
  class JWTCreatedListener
  {
      public function onJWTCreated(JWTCreatedEvent $event)
      {
          $expiration = new \DateTime('now');
          $expiration-&gt;add(new \DateInterval('PT10S'));
          $payload = $event-&gt;getData();
          $payload['exp'] = $expiration-&gt;getTimestamp();
          $event-&gt;setData($payload);
      }
  }
  </code></pre>
  
  <p>And, of course, I've marked the listener to observe the event</p>
  
  <pre><code>acme_api.event.jwt_created_listener:
      class: AppBundle\EventListener\JWTCreatedListener
      tags:
          - { name: kernel.event_listener, event: lexik_jwt_authentication.on_jwt_created, method: onJWTCreated }
  </code></pre>
  
  <p>If I get a token with Postman and use it to make following requests I can make those request for days and days. The token never expire. My JWTCreatedListener does not seem to work.</p>
  
  <p>What's wrong?</p>