jti verification doesn't prevent replays

[iffy]

According to the spec the jti claim is intended (can be used) to prevent replay attacks. This implementation doesn't do that, correct?

https://github.com/progrium/ruby-jwt/blob/master/lib/jwt.rb#L156

If so, then is it misleading to claim support for jti on this page: http://jwt.io/ ?

I don't know Ruby and I don't know who's responsible for the data on jwt.io. I could be completely wrong.

[excpt]

That's right, at the current state of ruby-jwt there's no replay prevention implemented.

At the moment the replay prevention code has to be implemented by each project individually. IMHO we are supporting jti claim verification and this can be displayed on the jwt.io site. How to handle the exact jti values and replay prevention is a part for the developer how uses this lib at the moment.

[excpt]

A basic replay attack prevention is by now implemented.