Beginner LevelAuthentication & Authorization
Why are the exp (Expiration Time), iat (Issued At), and nbf (Not Before) claims critical in JWTs?
❓ Interview Prompt: Explain standard RFC 7519 registered claims (exp, iat, nbf), clock skew tolerances, and token lifetime enforcement.
Standard JWT specifications (RFC 7519) define registered metadata claims to manage token lifetimes:
Key Registered Claims:
1
'exp' (Expiration Time): Unix timestamp (in seconds) after which the token MUST NOT be accepted. Limits the damage window of leaked stateless tokens.
2
'iat' (Issued At Time): Unix timestamp identifying when the token was created. Used to invalidate tokens issued prior to password resets.
3
'nbf' (Not Before Time): Unix timestamp identifying the earliest time the token can be processed.
Clock Skew Tolerance:
Servers processing JWTs across distributed systems allow a small clock skew (e.g. 5 to 60 seconds) to account for minor server time drift.
Code Implementation Example
typescript
// Standard JWT payload with registered claims
const jwtPayload = {
iss: 'https://auth.company.com',
sub: 'user_1042',
aud: 'https://api.company.com',
iat: Math.floor(Date.now() / 1000), // Issued now
nbf: Math.floor(Date.now() / 1000), // Valid now
exp: Math.floor(Date.now() / 1000) + (15 * 60) // Expire in 15 mins
};💡Standard JWT registered claims payload (iss, sub, aud, iat, nbf, exp).
🎯 Interview Key Takeaway
The exp claim enforces token lifetimes, limiting the vulnerability window of leaked stateless JWTs.
#JWT#Claims#Expiration#RFC 7519#Beginner
Back to all Authentication & Authorization Questions→