title: Laravel Passport authentication via cookie - expire on logout?
body: <p>In my project, I am integrating Laravel Passport in order to use my API in my application, as described <a href="https://laravel.com/docs/5.5/passport#consuming-your-api-with-javascript" rel="noreferrer">here</a>.</p>
  
  <p>My question is about the expiry of the <code>laravel_token</code> cookie. As can be seen <a href="https://github.com/laravel/passport/blob/4.0/src/Guards/TokenGuard.php#L168" rel="noreferrer">here</a>, the cookie sent back by my application is checked to verify it has not expired. This expiry seems to be defined by my session lifetime - see <a href="https://github.com/laravel/passport/blob/4.0/src/ApiTokenCookieFactory.php#L51" rel="noreferrer">here</a>.</p>
  
  <p>This seems to imply that the laravel_token cookie wil remain valid even after the user of my application has logged out, as long as the session time has not expired (Indeed, it seems to be the case that if I delete all sessions on the server and logout my user, API requests using the cookie still succeed).</p>
  
  <p>Is this intended behaviour? And is there a way to automatically make the cookie expire if the user logs out? (I know the cookie is removed from the user's system, but I'm looking at it from the theoretical possibility that the cookie is hijacked or stolen, and can then be used for as long as the session lifetime has not expired).</p>