exp token is handled as a mandatory token, but it is not.

AnthonyDeroche / mod_authnz_jwt

An authentication module for Apache httpd using JSON Web Tokens

Other

79 stars 46 forks source link

exp token is handled as a mandatory token, but it is not. #39

Closed nikosft closed 4 years ago

nikosft commented 4 years ago

If a token does not contain the exp claim, then authorization is not completed (Check starts at line 1165 of mod_authnz_jwt.c. However, JWT RFC clearly states the exp claim is optional (https://tools.ietf.org/html/rfc7519#section-4.1.4)