Skip to content

Remove "not before" claim "nbf" from JWT access token #1542

Closed
@jbman

Description

A Hydra JWT access token contains the “not before” claim with the same value as “issued at”.
Example:
{
“exp”: 1565861736,
“iat”: 1565858136,
“nbf”: 1565858136,

}

This could lead to failing validations, if a resource server hasn’t the correct time set or has some seconds clock skew which but strict “not before” validation.
In addition, I think there is no point to set “nor before” to the “issued at” timestamp. This claim seems to be intended for use cases where a future date is given, so that a client can not use a token immediately (e.g. a subscription starts tomorrow and can not be used directly after token creation, see https://stackoverflow.com/questions/43291659/usage-of-nbf-in-json-web-tokens).

According to https://tools.ietf.org/html/rfc7519#section-4.1.5 the nbf claim is optional. Other implementations do not provide a “nbf” claim. Or they provide one which is set to value 0.

Proposal
Do not add a "nbf" claim by default.
To create tokens which are valid in the future, the nbf value should be controlled by client configuration or login application.

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions