nbf not set when creating simple but then validates about reallysimplejwt

[RobDWaller]

Is it possible for you to share a snippet of the code you are using for me to test this.

Also what version are you using?

[andrewhollowaybreward]

Hi Rob,

Sorry for the delay!

The entry in my composer.json file is: -

"rbdwllr/reallysimplejwt": "^3.1",

Here is my JwtTokenService which handles the creation and validation, I simply call create and then use the validate method to check the tokens validity.

<?php

namespace App\Domain;

use ReallySimpleJWT\Token;

final class JwtTokenService
{
    private $secret;
    private $issuer;
    private $expiration;

    public function __construct(string $secret, string $issuer, int $expiration)
    {
        $this->secret = $secret;
        $this->issuer = $issuer;
        $this->expiration = $expiration;
    }

    public function create(int $userId): string
    {
        $expires = time() + $this->expiration;
        $token = Token::create($userId, $this->secret, $expires, $this->issuer);
        return $token;
    }

    public function validate(string $token): bool
    {
        if (empty($token)) {
            return false;
        }

        return Token::validate($token, $this->secret);
    }

    public function getHeader(string $token): array
    {
        return Token::getHeader($token, $this->secret);
    }
}

I only get the error when running in debug mode, I am using Visual Studio Code as an IDE using XDebug and the Felix Becker PHP Debug extension.

I get the following error message in parse.php on line 259: -

Exception has occurred.
ReallySimpleJWT\Exception\ValidateException: Not Before claim is not set.

[RobDWaller]

Apologies for the slow response. So I've had a look into this and it is correct that this exception should be thrown in this scenario. However this is an internal exception that is caught within the Token class. I'd guess that the issue here is to do with running this code in debug mode at which point I assume any exception will cause a run time failure.

So there are a couple of solutions to this problem.

1. Use the Token::customPayload() method and set an nbf claim to time() - 20 or something similar.
2. Interact with the underlying Build and Parse classes directly.

This issue should be resolved though within version 4.0.0 as validation will be handled slightly differently.