Is expired value validation works?

[offtza01]

Hello, I've tried both - by Dockerfile build, and from image; in both ways, it seems that exp value is not checked.
If token not set - 401 on nginx is set, but when is set, token goes to application no metter expiration date is wrong or not.

My configuration is:
location ~ ^/index\.php/api/test(/|$) {
auth_jwt_key /var/www/symfony_docker/var/keys/public.key file;
auth_jwt_alg RS256;
auth_jwt on;
[...]
}

eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJ0ZXN0Y2xpZW50IiwianRpIjoiM2M2NzdlYzk3NzYxNzZjYjI5MWE1NmY2ZjBlMTAxNDg3NWU1NzdhYzA2NGQwY2UwNDVhMmIxYmMyNzAxZjkyNTRmOGQ2NmMyODk1ZmZjYzIiLCJpYXQiOjE2OTg3NDIxODUuMzY3ODc1LCJuYmYiOjE2OTg3NDIxODUuMzY3ODg2LCJleHAiOjE2OTg3NDIyNDUuMzM2NDIxLCJzdWIiOiIwZmYzNDYyOC03MzYyLTExZWUtYTRkYS1jMTBiZDMxZTllNzciLCJzY29wZXMiOlsiYmxvZ19yZWFkIiwicHJvZmlsZSIsImVtYWlsIl0sImtpZCI6IjEiLCJjdXN0b20iOnsiZm9vIjoiYmFyIn19.fI0PgVF8fxm9OAV-lvB8RHb1DvnNz7RYotd4yp6M-8eZ77ftZqOpvZ1-UobRrf8CJUVZgejtP2jbdsyC6_7D4e1cf9ry9qxyu76NOPsZ51fhHmoa4IGV6e1EKuZQB9pOrpc_Rmu2UAq1mv4RRhiTc3wMFP3SkJ4FpHkILWeFt_K8HfQazML4TiMJ5S9wuzcUOPfcFfMVwn07wKO7TeGXuvoPe6HMrLhTZtyZzZoSYt0H7cCDvSJCj3fhr3xdrjUb6uxJBpf16-qvtX6IZbXixYhK-2NhVvxFibSRh2bSNnOg5yGH7gX6-VMwvkdoNVacMlCFnd9ec1GT2NablnueF14l1YxRA4O0azeHdCveJmc8wE5S2feTQMYInUQpWtZK0tejT28Vvy-EWWNQP9h1Yi5V5AkeKIwE6y0uCfF07WaMaFWuFjeGZep4nmD9D9vUSZq7k1KmAAPenKXRt3MA1cG_XE4ugOizqZ5fh95R7PobPMHq65wojjF7yIlNvHpfpYycbeIywCn13Kcfzeap9Ty30SxBtQq3KtZmE4AptAyiPHkj8pj6qxLzSn21R3aDa9jq0GLbK_hoY6QVEXmDPJdV0rLcRNLbgGsEdpIASoFI3uopeE1dnz_Ob-b4fm9B8LQpmrDFecLydDtcnIB0LlHeuN_PffGuDp3h8lDo93w

[max-lt]

Interesting, seems that the value is not parsed when using fractional values, I reported the issue to the libjwt author, see benmcollins/libjwt#188

In the mean time, you have to use integers for the exp value.

[offtza01]

Sorry, but i don't see any difference, works the same:

eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJ0ZXN0Y2xpZW50IiwianRpIjoiMDg3OTBlYmE1ZGZkOGU2ZjRkZjM2Y2EyNTQwZDU0ODc2YmM0Y2VkMzYyY2JiYjYwNzQ2MjlhOTEzNTU3NGMwOWU4MTU3MTBhYTU3ZTMwMTYiLCJpYXQiOjE2OTg3NzQ5NjQsIm5iZiI6MTY5ODc3NDk2NCwiZXhwIjoxNjk4Nzc1MDI0LCJzdWIiOiIwZmYzNDYyOC03MzYyLTExZWUtYTRkYS1jMTBiZDMxZTllNzciLCJzY29wZXMiOlsiYmxvZ19yZWFkIiwicHJvZmlsZSIsImVtYWlsIl0sImtpZCI6IjEiLCJjdXN0b20iOnsiZm9vIjoiYmFyIn19.FIIqgfd8l_wHeKe_WRavLMChW3jxcXvjtQFx1wlYgmpLRZKmrZjcF1I7DJc9LKqAGkpaV0uBUikFnrT6XDM6N8hEaZHYiGPJp_v56H-iyERZaLgaPFd8gkb-nS4fHiz87F3cu-rUOSbyez4z-ep8xnInD5xg99KVJIGpHjkI3uDcLA2AErpHit4u6e5B8HjxZL9tht65EnNbJI9_to84Kh1BOFFWIPmAXO-1BRXwTWkam7P43XjqSdQ48PEulWq6lveRDHja5sfOvDlxkKJpa1p-mI37wI0n8w8J_w436ZOEqC_D4j_41e3ZlVOBWFqI3i8EZ5Rc4h8oioGm1BHhnlJzOZR6pyZ6HQE86NspI-_qjx6i8g-nPMUnBDNtWyDnGEDlWdwT29Dy00ldJU73UCo3z6bcz_B0PnQJARzDtvt32hlFBC0nPE_769ByIG-C-w08Gm1g1Q7J5kNCbgDWE8jpcOCENLYJinFdCEztb3d7qhV1SEqPfdMZVXKySkylzsCST2MDIoOBMhXKHTDu44oZInkIH01nxWPYNbAZrNjqhn2DXSZaYshmmBOSOOpvdlD8FSijhNXen9bdEvPdyymDe6iKhRJjzEOJuQ_6K7SkJ1p30k6KvMrcK8pl7lIDN-o_KClXlyV43l8FVPEtga7swom-e5tJsbO4qN6ZjIQ

[offtza01]

IMHO it would be great to make some "debug mode" to not disturbing discuss panel with that kind of mess. If only I could see in logs what's happenieng, it would be great!

[max-lt]

Tested with:

No exp -> 201

JWT="eyJhbGciOiJIUzI1NiJ9.e30.-gVyhFDs5NeX0yvaAoTPVgrDfrg_qk7dF0sNj_-Bu-c" # secret = 'inherited-secret' (utf8)

With exp integer -> 401

JWT="eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2OTg3NDIyNDV9.iHiHQiTY-SNIv4k9Cxg-3V5x1aF9riOYMd3kkhnYVGI"

{
  "exp": 1698742245
}

With float -> 201

JWT="eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2OTg3NDIyNDUuMzM2NDIxfQ.Wh-6szLG-7TcO19Efwh5A7IBoMWPPfttxwgUFKBhDJA"
{
  "exp": 1698742245.336421
}

With a token like yours:

With alg=RS256 + fractional -> 201

eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJ0ZXN0Y2xpZW50IiwianRpIjoiMDg3OTBlYmE1ZGZkOGU2ZjRkZjM2Y2EyNTQwZDU0ODc2YmM0Y2VkMzYyY2JiYjYwNzQ2MjlhOTEzNTU3NGMwOWU4MTU3MTBhYTU3ZTMwMTYiLCJpYXQiOjE2OTg3NzQ5NjQuMTIsIm5iZiI6MTY5ODc3NDk2NC4xMiwiZXhwIjoxNjk4Nzc1MDI0LjEyLCJzdWIiOiIwZmYzNDYyOC03MzYyLTExZWUtYTRkYS1jMTBiZDMxZTllNzciLCJzY29wZXMiOlsiYmxvZ19yZWFkIiwicHJvZmlsZSIsImVtYWlsIl0sImtpZCI6IjEiLCJjdXN0b20iOnsiZm9vIjoiYmFyIn19.pWabtCrKP9STog0hbgrzPBoFK6H1_Of7fAU4Txa6x7bHOF46eaaAi0QwThhuLgu63daspoGylOrTOqq2XFDUVG6KeNok2GQvfdAhGdZ60SFH08u6zlKlFhf6n8G6yxbPNcnu70tQ6cof0IX2KrY68aXQXS2R0k6bUWPqdKg1hQiFMqKXA64jsBAE5uJKRWPKzLWQ6aJ1pMLqCv2qDpiwotXy-za8RgpeFtqgjiXoWhxopLaF1icPhAW6HBvzVLcvDgqHjhBeDLGroI_QVRq45K4e1w9nYGTAHEynXO_XkFdwKHhAz1uPFFjv38Rrfj5YnqhAR-kn-Myh8f4c4WGrcQ

with alg=RS256 + integer -> 401

eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJ0ZXN0Y2xpZW50IiwianRpIjoiMDg3OTBlYmE1ZGZkOGU2ZjRkZjM2Y2EyNTQwZDU0ODc2YmM0Y2VkMzYyY2JiYjYwNzQ2MjlhOTEzNTU3NGMwOWU4MTU3MTBhYTU3ZTMwMTYiLCJpYXQiOjE2OTg3NzQ5NjQsIm5iZiI6MTY5ODc3NDk2NCwiZXhwIjoxNjk4Nzc1MDI0LCJzdWIiOiIwZmYzNDYyOC03MzYyLTExZWUtYTRkYS1jMTBiZDMxZTllNzciLCJzY29wZXMiOlsiYmxvZ19yZWFkIiwicHJvZmlsZSIsImVtYWlsIl0sImtpZCI6IjEiLCJjdXN0b20iOnsiZm9vIjoiYmFyIn19.J8gwJaLWYFNie8Zf-34o3nxwuz496rGlHkAJaIgEVNGYj4ip26S8yr152LrYRxK3PTpxkxBb389oFgPgnV4oa7-kfpZ9AK_qgp-PGKcbPJpZU6t2WTy05Bdify-OxoyZXT5uM4PYBaCMwLKIlzKlMfXVRsAXCoXaY0YRk5G2FB_OqhDGcKYCqJDyszqMoKc6bpiR795Zb_UEXhdpZ1sbzBprnDBcGsLoIwqztOqC84-E1SHgaiaQJj_m-Ypyj0YTEKaEimyu48a0yJ-5NKO46-34JNms3XGd5e1CdOnCAnKRWmfdNAS4_h-UOTqiEt9JB7rNhbzIJo93D_FWm3ra_A

To reproduce:

# Build main image
docker build -f Dockerfile -t jwt-nginx .

# Build test image
make test/image

# Run test image
docker run -p 8000:8000 -v $PWD/test-image/nginx:/etc/nginx jwt-nginx-test

export JWT='<JWT>'

# Test alg=RS256
curl -X GET --head http://localhost:8000/rsa-file-encoded-alg-256 --header "Authorization: Bearer ${JWT}"

# Test alg=HS256
curl -X GET --head http://localhost:8000/secure-auth-header --header "Authorization: Bearer ${JWT}"

If it still does not works, can you post the test image output please ?

[max-lt]

Hi, I just commited changes to handle exp with a fractional value, it should works for you now (v.3.4.0)