IssuedAt claim is not verified when jwt.WithIssuedAt() option is given to Parser

[ahola-ookla]

In jwt/validator.go, the validation logic for IssuedAt is:

	// Check issued-at if the option is enabled
	if v.verifyIat {
		if err = v.verifyIssuedAt(claims, now, false); err != nil {
			errs = append(errs, err)
		}
	}

Because the last parameter to v.verifyIssuedAt(claims, now, false) is false, IssuedAt is not verified even if v.verifyIat is true.

The correct logic is to use v.verifyIssuedAt(claims, now, true).

[oxisto]

Do you have an example where this would occur? The third parameter only check if is is REQUIRED, so currently the behaviour is that it will check the IAT, if its in the token. We can think about a similar solution as with NBF, where if I am not mistaken we have two options, one for the check and one for whether it is required or not.

[ahola-ookla]

When a token is parsed like this:

token, err := jwt.Parse(tokenString, keyfunc,
    jwt.WithAudience(expectedAudience),
    jwt.WithIssuer(expectedIssuer),
    jwt.WithExpirationRequired(),
    jwt.WithIssuedAt())

The aud, iss and exp are required but iat is optional. In this example, iat should be required like the other claims. The api does not have any way to make iat required.

[oxisto]

When a token is parsed like this:

token, err := jwt.Parse(tokenString, keyfunc,
    jwt.WithAudience(expectedAudience),
    jwt.WithIssuer(expectedIssuer),
    jwt.WithExpirationRequired(),
    jwt.WithIssuedAt())

The aud, iss and exp are required but iat is optional. In this example, iat should be required like the other claims. The api does not have any way to make iat required.

Can you please prepare a pull request that implements that desired change (including possible test adjustments)? Then we can discuss the options in that pull request. Thank you!

[equalsgibson]

Hey @ahola-ookla, are you still interested in creating a PR for this one? If not, I can put up an initial PR to implement the changes 👍

[oxisto]

So FYI, since we are starting the v6 development cycle, I am in general open to improve the validation (option) system altogether. I don't necessarily want to completely break everything but I feel that the current way with the different jwt.WithVeryLongOption might not be the best or most user-friendly way. Maybe we should have a discussion issue about how a potential new system could look like?