search

gofiber / jwt

⚠️ Deprecated repository, available within Fiber Contrib.
https://github.com/gofiber/contrib/tree/main/jwt
MIT License
394 stars 31 forks source link

Seems expiration is not checked #92

Closed kuchaguangjie closed 2 years ago

kuchaguangjie commented 2 years ago

Seems exp in jwt.MapClaims is not validated. In my test, after a token expired, it can still be used.

I've check the source code of jwtware.New(), seems there is no where exp is checked. Or, did I missed something? The token being generated is ok, because I parsed the token and check the exp field, the value is correct. The desired behavior is that, after the token expired, server should return http code like 401.

BTW, I tested it in both v3.2.11 and v3.2.12.

kuchaguangjie commented 2 years ago

My bad, it did return 401, I checked the wrong api ... (which is a websocket api, I skipped it for jwt)