Claims live on a timeline
02Expiration and not-before define a token’s permitted time interval when these claims are present.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 4.1.4 ↗
RFC 7519 · § 4.1.4EXAMPLE
4 / 4
04
Expired.
At time 160 the expiration check fails, absent a configured clock-skew allowance.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Accept at or after nbf, and strictly before exp.
- exp and nbf use NumericDate: seconds since the Unix epoch, ignoring leap seconds.
- iat records issuance time; it does not itself define an expiration.
- Small leeway for clock skew is permitted; an application must define its policy.
The examples simplify the wire representation. Follow the linked specification and application profile for implementation.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy