Keats / jsonwebtoken

JWT lib in rust
MIT License
1.67k stars 266 forks source link

Getting Error `Missing required claim: exp` even when `validate_exp` is false #261

Closed LuisOsta closed 2 years ago

LuisOsta commented 2 years ago
pub fn verify_token(secret: String, token: String) -> Result<Claims, jsonwebtoken::errors::Error> {
    let mut validation = jsonwebtoken::Validation::new(JWT_ALGORITHM);
    validation.validate_exp = false;
    let data = jsonwebtoken::decode::<Claims>(
        &token,
        &jsonwebtoken::DecodingKey::from_secret(secret.as_bytes()),
        &validation,
    )?;

    Ok(data.claims)
}

This is the way that I'm using the jsonwebtoken library where the Claims struct is

#[derive(Debug, serde::Serialize, serde::Deserialize)]
pub struct Claims {
    pub sub: String,
    pub name: String,
}
LuisOsta commented 2 years ago

I saw https://github.com/Keats/jsonwebtoken/issues/239. But why not have it also not care if its absent/present if validate_exp is set to false?

Keats commented 2 years ago

But why not have it also not care if its absent/present if validate_exp is set to false?

Presence/absence and validation are two different things. You might want to enforce having an exp field but not want to validate it with the crate because you're not using the standard timestamp for example.