It seems that the library changed the way it checks for expired tokens from manual handling to throwing exceptions. And now you can put a random JWT token as an expired token if you obtain a refresh ...