php - Flow of token refreshing using JWT on Laravel Lumen -

i'm building first api jwt. i'm using boilerplate project: https://github.com/krisanalfa/lumen-jwt

i managed make work well, i'm having big problem: user token expires after time, logging user off application. i've read on documentation of project call /api/auth/refresh refresh token, right seems me has 2 major drawbacks:

1) have make single call api refresh token, imagine have set timer call every x minutes (time of token expiration).

2) if user turns off computer 3 hours, when turns on, token have expired, rendering refresh unusable, , logging user off.

since i'm new this, missing something? how can make token refresh cycle work without these drawbacks?

taking 2 points.

1) can make token valid single use, using blacklist feature. isn't entirely necessary.

in own project, gave tokens 5 minute expiry, applied jwt-refresh middleware authenticated routes (wrapped in route group), new token returned every request.

2) can specify refresh expiry, window during expired token can authenticated. longer token. used 14 days.

therefore, if user leaves website 3 hours , comes back, token have expired. app should attempt refresh token in background , re-attempt original request.

give thought obvious security implications of respective token lifetimes. 5 minutes short window abuse, if expired token can refreshed 14 days, increases risk, unless you're blacklisting it.