The javadoc for JwtParser.parse documents that it throws a ExpiredJwtException if the JWT has expired.
The code for DefaultJwtParser.parse validates both iat and nbf (if they are present, subject to allowed skew), and throws ExpiredJwtException for an expired token and also a PrematureJwtException if the token is not yet valid.
If the intent is for all implementations of JwtParser to enfore both iat and nbf it would be nice to have explicit documentation of that fact.
It would also be nice to have an indicator of which fields will be validated during parsing in the main body of the javadoc description of the parse method.
The javadoc for JwtParser.parse documents that it throws a
ExpiredJwtExceptionif the JWT has expired.The code for DefaultJwtParser.parse validates both
iatandnbf(if they are present, subject to allowed skew), and throwsExpiredJwtExceptionfor an expired token and also aPrematureJwtExceptionif the token is not yet valid.If the intent is for all implementations of JwtParser to enfore both
iatandnbfit would be nice to have explicit documentation of that fact.It would also be nice to have an indicator of which fields will be validated during parsing in the main body of the javadoc description of the
parsemethod.