A note has a usable time window
05A server clock sits between an optional starting time and a required ending time. An optional identifier book can reject a second use.
The worked clock uses small second counts for readability.
Offline worked example. Only the public signature/MAC fixtures receive real local cryptographic checks. Other trust, grant, clock and permission inputs are selected teaching cases.
What happens if you change this?
Predict whether the request will pass. Change one choice to see why; use Restart to restore the original example.
This example chooses zero clock tolerance and a 60-second maximum iat age.
Key idea: Expiry is required; other time labels and replay memory are optional.
Terms
- assertion
- A statement another system can check; here it is carried as a JWT.
- authorization grant
- Evidence supporting a request for an access token.
- client authentication
- Checking which app made the request.
- token endpoint
- The server address where an app requests tokens.
- JWT
- JSON Web Token: a compact container for named statements.
- issuer
- The system that created the statement.
- subject
- Who or what the statement is about.
- audience
- The intended receiver of the statement.
- claim
- A named piece of information inside the JWT.
- signature
- A checkable result over bytes made with a secret signing key.
- MAC
- A check over bytes made with a key shared by the parties.
- RS256
- A secret signing key makes a checkable signature; a matching shareable key checks it.
- HS256
- A shared secret lets either party make and check a result over the bytes.
- exp
- Required ending time for using this JWT.
- nbf
- Optional time before which this JWT must not be accepted.
- iat
- Optional time when the JWT was issued.
- jti
- Optional identifier for this JWT; a server may remember it to detect reuse.
- scope
- The named permission requested, such as reading pictures.
- bearer assertion
- A statement usable by someone who possesses it, without proving possession of a separate signing key on each request.
Rules & examples
Expiry is required; other time labels and replay memory are optional.
These reference examples may differ from the selected experiment.
- Real JWT time claims count seconds from 1970-01-01T00:00:00Z; this clock uses small counts to make the arithmetic visible. exp is required; nbf, iat and jti are optional. Honor nbf when present. Reject expired assertions subject to allowable clock skew. The server MAY reject exp too far ahead or iat too far behind, and MAY remember used jti values for their validity interval. This diagram chooses zero skew and rejects iat ages over 60 seconds; those are example policy values, not RFC constants. Replay protection is not mandated.
Bounded offline examples; crypto fixtures are separate from the selected trust and permission policy.
Sources
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.