Open
Description
This was an issue found during the work I did for #497.
What
Passing -Infinity
, Infinity
and NaN
for nbf
in the payload is not caught by the claim validation. Since these values all JSON.stringify
to null
, they should be treated similar to passing null
to nbf
.
Test Case
const jwt = require('jsonwebtoken');
console.log(jwt.sign({nbf: Infinity}, undefined, {algorithm: 'none'}));
console.log(jwt.sign({nbf: -Infinity}, undefined, {algorithm: 'none'}));
console.log(jwt.sign({nbf: NaN}, undefined, {algorithm: 'none'}));
Expected Output
Error with message "nbf" should be a number of seconds
for each sign
call.
Actual Output
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJuYmYiOm51bGwsImlhdCI6MTUzMDAzMTcxM30.
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJuYmYiOm51bGwsImlhdCI6MTUzMDAzMTcxM30.
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJuYmYiOm51bGwsImlhdCI6MTUzMDAzMTcxM30.
Which decodes as:
{
"nbf": null,
"iat": 1530031713
}
Metadata
Metadata
Assignees
Labels
No labels