Expiry field is required but may be set to null

[andrewzhurov]

According to the spec, Expiry field is required but may be set to null to convey "never expires". Are there reasons to have the field set to null vs having it absent (optional)?

There are several reasons to prefer having it optional:

1. Adheres to the JWT spec
2. Makes for a uniform way of conveying absence, as it is for nbf & other fields.
3. Makes for a more sound absence semantic, this great talk gives a fine mindset for it

[Gozala]

Are there reasons to have the field set to null vs having it absent (optional)?

Intention had been to have an explicit signal and catch malformed UCANs that accidentally omitted this field.

[expede]

Yeah, an expiry was required (arguably it still should be, though there are hacks around that). Ergonomically, making this field required means that people have to at least think about POLA.