How do we address the slight mismatch between JWT expiration and the model's lifetime options?

[xtagon]

Hi,

Suppose you provide a model callback to generate signed JWT tokens (for both access token + refresh token) instead of the default randomized ones. When the HTTP request is handled, the returned JSON field for expires_in may not exactly match the expiration that was signed as part of the exp claim in the JWT payload. The client then has the wrong expires_in -- although depending on timing, it may be close.

How do others using this library solve for this? It appears that the getAccessTokenExpiresAt and getRefreshTokenExpiresAt functions do not have knowledge of the token model, so I'm not sure if I could fix this simply by re-implementing each of the grant types.

Any suggestions? TIA