SpringBoot集成Shiro实现JWT刷新的问题

Question

SpringBoot集成Shiro实现JWT刷新的问题，请问应该在哪个类里面实现刷新token并且如何在请求返回时返回新的token（如何在Controller里获取新的token）给用户呢？

当前我的代码是这样的，在Realm的登录验证里进行JWT的验证，但当判断JWT已经过期但仍然可以刷新时我就不知道应该怎么写了，是应该抛出异常给 自定义的ShiroFilter然后再重定向一个新的请求吗还是怎么样？求大神解答一下，谢谢！

public class MyRealm extends AuthorizingRealm{

    private Logger LOGGER = LoggerFactory.getLogger(this.getClass());
    
    @Resource
    private UserBiz userBiz;
    
    /**
     * 大坑！，必须重写此方法，不然Shiro会报错
     */
    @Override
    public boolean supports(AuthenticationToken token) {
        return token instanceof JWTToken;
    }

    
    /**
     * 权限认证
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
        String token = principals.getPrimaryPrincipal().toString();
        LOGGER.info("进入Realm的权限验证:"+token);
        String username = JWTUtil.getUsername(token);
        System.out.println("Realm获取到的username:"+username);
        User user = userBiz.findByName(username);
        
        List<Role> roles = userBiz.selectRoleByUser(user);
        for(Role role : roles){
            simpleAuthorizationInfo.addRole(role.getName());
            List<Permission> permissions = userBiz.selectPermissionByRole(role);
            for(Permission per : permissions){
                simpleAuthorizationInfo.addStringPermission(per.getName());
            }
        }
        
        return simpleAuthorizationInfo;
    }


    /**
     * 登录认证
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken auth) throws TokenExpiredException,AuthenticationException {
        String token = auth.getPrincipal().toString();
        LOGGER.info("进入Realm的登录验证:"+token);
        String username = JWTUtil.getUsername(token);
        if(username == null){
            LOGGER.info("token获取到的username为空");
            return null;
        }
        
        User user = userBiz.findByName(username);
        if(user == null){
            return null;
        }
        
        try {
            JWTUtil.verify(token, username, user.getPassword());
        } catch (TokenExpiredException e) {
            //验证失败,token过期,
            LOGGER.info("token过期");
            if(JWTUtil.verifySignDate(token)){
                LOGGER.info("仍在token的刷新时间内,可以生成新的token");
                //在这里应该怎么实现刷新token
                return null;
            }
        } catch (Exception e) {
            LOGGER.info("验证失败");
            return null;
        }
        
        return new SimpleAuthenticationInfo(token, token, "my_realm");

    }
}