in decode_complete method, it merges self.options and options and "verify_exp" is set in self.options.
it makes _validate_claims method check expiration time even though I didn't request to check exp.
(i call jwt.decode with require option which doesn't have "exp")
Expected Result
no exception raised
Actual Result
ExpiredSignatureError("Signature has expired") is raised
Reproduction Steps
call jwt.decode method with expired token and require option which doesn't have exp
import jwt
require = ["iat", "iss", "sub"]
return jwt.decode(
token, # this token has exp field but expired
settings.JWT_SECRET,
algorithms="HS256",
issuer=settings.JWT_ISSUER,
options=dict(require=require, verify_signature=True),
)
in decode_complete method, it merges self.options and options and "verify_exp" is set in self.options. it makes _validate_claims method check expiration time even though I didn't request to check exp. (i call jwt.decode with require option which doesn't have "exp")
Expected Result
no exception raised
Actual Result
ExpiredSignatureError("Signature has expired") is raised
Reproduction Steps
call jwt.decode method with expired token and require option which doesn't have exp
System Information
This command is only available on PyJWT v1.6.3 and greater. Otherwise, please provide some basic information about your system.