auth0 / java-jwt

Java implementation of JSON Web Token (JWT)
MIT License
5.84k stars 921 forks source link

Fix for `exp` claim considered valid if equal to now #652

Closed jimmyjames closed 1 year ago

jimmyjames commented 1 year ago

As discussed in #646, the current date/time must be before the exp claim's value.

From the spec, section 4.1.4 (emphasis added):

The processing of the "exp" claim requires that the current date/time MUST be before the expiration date/time listed in the "exp" claim.

This change ensures that the current time is before the exp claim's value (if present).

Fixes #646