jwt: Handle the verification of the expiration claim properly

anthonycastelli · Apr 27, 2017 · 14d2ece · 14d2ece
1 parent c94bcdf
commit 14d2ece
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/Sources/App/Models/User.swift b/Sources/App/Models/User.swift
@@ -62,7 +62,7 @@ extension User {
 
             // Verify the token
             try receivedJWT.verifySignature(using: HS256(key: Authentication.AccessTokenSigningKey.makeBytes()))
-            if receivedJWT.verifyClaims([ExpirationTimeClaim(Date() + Authentication.Length)]) {
+            if receivedJWT.verifyClaims([ExpirationTimeClaim(Date())]) {
                 guard let userId = receivedJWT.payload.object?[SubjectClaim.name]?.string else { throw IncorrectCredentialsError() }
                 user = try User.query().filter("id", userId).first()
             } else {