djangorestframework-simplejwt icon indicating copy to clipboard operation
djangorestframework-simplejwt copied to clipboard

Published 20 hours ago • verified publisher icon jazzband

Caim "Issued At" not updated after token refresh

Open lwalejko opened this issue 1 year ago • 0 comments

When a token is refreshed, the iat (Issued At) claim is copied from the refresh token instead of setting it as a current time. According to RFC (https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.6):

The "iat" (issued at) claim identifies the time at which the JWT was issued.

Is current behavior expected, or is it a bug? If it's expected, could it be documented somewhere?

lwalejko avatar Jan 30 '24 04:01 lwalejko