token is still alive, when "exp" = NOW about java-jwt HOT 2 CLOSED

Hey @taisuke-fujimoto, thanks for the issue and test case. Yes, the specification states that the exp must be before the current time, so it looks like there is an off-by-1 second here.

from java-jwt.

The problem is in the assertInstantIsFuture method.

The specification states:
The "exp" (expiration time) claim identifies the expiration time on or after which the JWT MUST NOT be accepted for processing. The processing of the "exp" claim requires that the current date/time MUST be before the expiration date/time listed in the "exp" claim.

That means:

• A token isn't expired and valid if NOW < exp
• A token is expired if NOW >= exp

The method assertInstantIsFuture checks for a valid token with:

• !now.isAfter(exp) => !(NOW > exp)

The correct way should be:

• NOW < exp => now.isBefore(exp)

from java-jwt.