search

dgrijalva / jwt-go

ARCHIVE - Golang implementation of JSON Web Tokens (JWT). This project is now maintained at:
https://github.com/golang-jwt/jwt
MIT License
10.78k stars 997 forks source link

Major Issue: ExpiresAt not optional despite claims #461

Closed benjaminmordaunt closed 3 years ago

benjaminmordaunt commented 3 years ago

The exp claim is not optional (it cannot be zero), as the current code base stands. ExpiresAt is marked as omitempty here: https://github.com/dgrijalva/jwt-go/blob/dc14462fd58732591c7fa58cc8496d6824316a82/claims.go#L20

... but then during the Validation steps, it directly accesses c.ExpiresAt without a check! https://github.com/dgrijalva/jwt-go/blob/dc14462fd58732591c7fa58cc8496d6824316a82/claims.go#L39

This causes a panic when ExpiresAt is 0.

benjaminmordaunt commented 3 years ago

See #460