Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix for exp claim considered valid if equal to now #652

Merged
merged 1 commit into from
Jan 26, 2023
Merged

Conversation

jimmyjames
Copy link
Contributor

@jimmyjames jimmyjames commented Jan 26, 2023

As discussed in #646, the current date/time must be before the exp claim's value.

From the spec, section 4.1.4 (emphasis added):

The processing of the "exp" claim requires that the current date/time MUST be before the expiration date/time listed in the "exp" claim.

This change ensures that the current time is before the exp claim's value (if present).

Fixes #646

@jimmyjames jimmyjames requested a review from a team as a code owner January 26, 2023 22:50
}

private boolean assertInstantIsPast(Instant claimVal, long leeway, Instant now) {
private boolean assertInstantIsLessThanOrEqualToNow(Instant claimVal, long leeway, Instant now) {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

renamed this method to be clearer

@jimmyjames jimmyjames merged commit 12ae664 into master Jan 26, 2023
@jimmyjames jimmyjames deleted the exp-fix branch January 26, 2023 23:04
@jimmyjames jimmyjames mentioned this pull request Feb 10, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

token is still alive, when "exp" = NOW
2 participants