psr-jwt icon indicating copy to clipboard operation
psr-jwt copied to clipboard

Not Before Time Equal to Current Time Fails Authorization

Open GHDevelop opened this issue 3 years ago • 0 comments

Currently, in src/Validation/Validate.php at method "notBefore" the comparison done between $notBefore and time() is <. If $notBefore and time() are identical (and time() is only precise to the second), then authorization will fail even though the token isn't being used before the not before time. I'm open to correction, but I get the impression that using <= instead would be appropriate, since there are cases where developers would generate a token (with not before time and issued at time set to the same value) and then quickly use it.

GHDevelop avatar May 10 '22 19:05 GHDevelop