Merge pull request #635 from Slamdunk/fix_34_exp_claim_RFC7519

[v3.4] Token must expire the exact time of "exp" claim
lcobucci · Jan 27, 2021 · cd83b54 · cd83b54
2 parents 3a98e23 + 9e12304
commit cd83b54
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 2 deletions.
diff --git a/src/Token.php b/src/Token.php
@@ -298,7 +298,7 @@ public function isExpired(DateTimeInterface $now = null)
 
         $now = $now ?: new DateTimeImmutable();
 
-        return $now > $this->claims->get(RegisteredClaims::EXPIRATION_TIME);
+        return $now >= $this->claims->get(RegisteredClaims::EXPIRATION_TIME);
     }
 
     /**

diff --git a/test/unit/TokenTest.php b/test/unit/TokenTest.php
@@ -956,6 +956,29 @@ public function isExpiredShouldReturnTrueAfterTokenExpires()
         $this->assertTrue($token->isExpired(new DateTime('+10 days')));
     }
 
+    /**
+     * @test
+     *
+     * @covers ::isExpired
+     *
+     * @uses \Lcobucci\JWT\Token::__construct
+     * @uses \Lcobucci\JWT\Token::convertToDataSet
+     * @uses \Lcobucci\JWT\Token::getClaim
+     * @uses \Lcobucci\JWT\Token::hasClaim
+     * @uses Lcobucci\JWT\Claim\Basic
+     * @uses Lcobucci\JWT\Claim\GreaterOrEqualsTo
+     */
+    public function isExpiredShouldReturnTrueAtTheSameTimeTheTokenExpires()
+    {
+        $now = new DateTimeImmutable();
+        $token = new Token(
+            ['alg' => 'none'],
+            ['exp' => $now]
+        );
+
+        $this->assertTrue($token->isExpired($now));
+    }
+
     /**
      * @test
      *

diff --git a/test/unit/Validation/Constraint/ValidAtTest.php b/test/unit/Validation/Constraint/ValidAtTest.php
@@ -144,7 +144,7 @@ public function assertShouldNotRaiseExceptionWhenLeewayIsUsed()
             RegisteredClaims::EXPIRATION_TIME => $now->modify('-5 seconds'),
         ];
 
-        $constraint = new ValidAt($this->clock, new DateInterval('PT5S'));
+        $constraint = new ValidAt($this->clock, new DateInterval('PT6S'));
         $constraint->assert($this->buildToken($claims));
 
         $this->addToAssertionCount(1);