#1070·jjwt

[Javadoc] The javadoc for JwtParser.parse does not specifically guarantee validation of iat and nbf

Author: ChristopherSchultzCreated Jul 23, 2026Updated Jul 23, 2026

The javadoc for JwtParser.parse documents that it throws a ExpiredJwtException if the JWT has expired. The code for DefaultJwtParser.parse validates both iat and nbf (if they are present, subject to allowed skew), and throws ExpiredJwtException for an expired token and also a PrematureJwtException if the token is not yet valid.

If the intent is for all implementations of JwtParser to enfore both iat and nbf it would be nice to have explicit documentation of that fact.

It would also be nice to have an indicator of which fields will be validated during parsing in the main body of the javadoc description of the parse method.