nbf validation fails when a non-integer value is passed in

Rounding down the current time when validating the nbf claim can result in a valid token being rejected if the nbf value is non-integer.

Line 50 in 74d5719

var clockTimestamp = options.clockTimestamp || Math.floor(Date.now() / 1000);

Example:

nbf = 1_646_822_341.111
Date.now() = 1_646_822_341_999
clockTimestamp = Math.floor(Date.now() / 1000) = 1_646_822_341
nbf > clockTimestamp

Navigation Menu