Getting new token using jwt strategy

[deskoh]

In v3, new tokens are are created by sending POST request to the /authentication endpoint. However, this no longer holds in v4 is jwt strategy is used.

This is likely due to:

feathers/packages/authentication/src/service.ts

Lines 101 to 103 in 2d95bfd

	if (authResult.accessToken) {
	return authResult;
	}

.

Is this behaviour intended? Consequently, a browser client with existing token will not get a new token with extended expiry if the browser is refreshed.

[daffl]

Yes this is intended for security reasons. Otherwise an attacker that managed to steal your token could get indefinite access to the application. Also see #960