title: JWT (JSON Web Token) automatic prolongation of expiration
body: <p>I would like to implement JWT-based authentication to our new REST API. But since the expiration is set in the token, is it possible to automatically prolong it? I don't want users to need to sign in after every X minutes if they were actively using the application in that period. That would be a huge UX fail.</p>
  <p>But prolonging the expiration creates a new token (and the old one is still valid until it expires). And generating a new token after each request sounds silly to me. Sounds like a security issue when more than one token is valid at the same time. Of course I could invalidate the old used one using a blacklist but I would need to store the tokens. And one of the benefits of JWT is no storage.</p>
  <p>I found how Auth0 solved it. They use not only JWT token but also a refresh token:
  <a href="https://auth0.com/docs/tokens/refresh-tokens" rel="noreferrer">https://auth0.com/docs/tokens/refresh-tokens</a></p>
  <p>But again, to implement this (without Auth0) I'd need to store refresh tokens and maintain their expiration. What is the real benefit then? Why not have only one token (not JWT) and keep the expiration on the server?</p>
  <p>Are there other options? Is using JWT not suited for this scenario?</p>