Fixed now causes iat to exceed now + leeway in JWTClaimsRegistry.validate_iat()

joserfc/src/joserfc/_rfc7519/registry.py

Lines 105 to 115 in d9c2e73

    
               def validate_iat(self, value: int) -> None: 
        
                   """The "iat" (issued at) claim identifies the time at which the JWT was 
        
                   issued.  This claim can be used to determine the age of the JWT.  Its 
        
                   value MUST be a number containing a NumericDate value.  Use of this 
        
                   claim is OPTIONAL. 
        
                   """ 
        
                   if not _validate_numeric_time(value): 
        
                       raise InvalidClaimError("iat") 
        
                   if value > (self.now + self.leeway): 
        
                       raise InvalidTokenError() 
        
                   self.check_value("iat", value)

When calling claims_requests.validate(decoded_token.claims), the now timestamp used for validation isn’t updated dynamically resulting in iat > now + leeway.

This is caused by the way you use the claims registry. You need to initialize a claims request every time you want to do the claim validation.

However, I can update the implementation so that the validator can be reused.

fix: generate now timestamp

Please check the code in main branch.

I've reviewed the code in the main branch! LGTM

Navigation Menu

Repository navigation

Fixed `now` causes `iat` to exceed `now + leeway` in `JWTClaimsRegistry.validate_iat()` #68

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	def validate_iat(self, value: int) -> None:
	"""The "iat" (issued at) claim identifies the time at which the JWT was
	issued. This claim can be used to determine the age of the JWT. Its
	value MUST be a number containing a NumericDate value. Use of this
	claim is OPTIONAL.
	"""
	if not _validate_numeric_time(value):
	raise InvalidClaimError("iat")
	if value > (self.now + self.leeway):
	raise InvalidTokenError()
	self.check_value("iat", value)

Fixed now causes iat to exceed now + leeway in JWTClaimsRegistry.validate_iat() #68

Description

Activity

lepture commented on Jul 30, 2025

lepture commented on Jul 30, 2025

lepture commented on Aug 25, 2025

kimminw00 commented on Aug 25, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Fixed `now` causes `iat` to exceed `now + leeway` in `JWTClaimsRegistry.validate_iat()` #68