Skip to content
Sarj Code Standards

require-jwt-lifetime

Require an expiration claim or a maximum token age when returning a verified JWT.

lifetime Rule source Tests Catalog JSON

Why

JOSE validates exp when present but does not require it by default, so otherwise valid tokens without an expiration may remain accepted indefinitely.

Fix

Set requiredClaims: ['exp'] or a finite maxTokenAge in jwtVerify options. Keep issuer and audience checks appropriate to the protocol.

Examples

Before — flagged A signature alone does not require expiration
auth.ts
import { jwtVerify } from "jose";
function verify(token, key) {
  return jwtVerify(token, key);
}
After — preferred Require the expiration claim
auth.ts
import { jwtVerify } from "jose";
function verify(token, key) {
  return jwtVerify(token, key, { requiredClaims: ["exp"] });
}

References