Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

expiration check does not give "Signature has expired" error for the exact time of expiration #157

Closed
vnc-zestfinance opened this issue Jul 20, 2016 · 0 comments

Comments

@vnc-zestfinance
Copy link

If for example, you want to have a JWT expire at 4 hours after current time, it still doesn't expire at the exact time specified (exp field). But it does expire like the second afterwards but according to JWT documentation, it should expire at or after the given time. Please see the logic difference between the following two diffs:

https://github.com/jwt/ruby-jwt/blob/jwt-1.5.2/lib/jwt.rb#L161 (working version)
https://github.com/jwt/ruby-jwt/blob/v1.5.4/lib/jwt/verify.rb#L38 (not working version)

Essentially you are missing a less-than-or-equal to, I believe. Please check it out.

@excpt excpt added the bug label Jul 24, 2016
@excpt excpt added this to the Version 1.6.0 milestone Jul 24, 2016
@excpt excpt modified the milestones: Version 1.5.5, Version 1.6.0 Aug 22, 2016
@excpt excpt added the security label Aug 22, 2016
@excpt excpt added WIP and removed WIP labels Aug 22, 2016
@excpt excpt closed this as completed Aug 23, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants