1. jwt有兩種tokenrefreshToken和accessToken,兩個都可以在AuthServiceProvider設置過期時間
2. 一種存在cookie里或localstorage里,一種存在session或sessionstorage
3. laravel 把refreshToken放在cookie里,把accessToken和過期時間放在body里返回
4. 前端按照返回數(shù)據(jù)保存兩種token
5. refreshToken過期則重新登錄,accessToken過期則用refreshToken換取accessToken
6. 可以用命令php artisan route:list查看所有auth相關api的路由

下面是一個綜合方法:

public function proxy($grantType, array $data = [])
    {
        $data = array_merge($data, [
            'client_id'     => env('PASSPORT_CLIENT_ID'),
            'client_secret' => env('PASSPORT_CLIENT_SECRET'),
            'grant_type'    => $grantType,
        ]);

        $http = new Client();
        $response = $http->post(url('oauth/token'), ['form_params' => $data,]);

        $token = json_decode((string)$response->getBody(), true);

        return response()->json([
            'token'      => $token['access_token'],
            'auth_id'    => md5($token['refresh_token']),
            'expires_in' => $token['expires_in'],
        ])->cookie('refreshToken', $token['refresh_token'], 14400, null, null, false, true);
    }