Skip to content

Document claims validation performed by JwtParser.parse - #1082

Open
kimseongchan0914 wants to merge 1 commit into
jwtk:mainfrom
kimseongchan0914:docs/jwtparser-claims-validation-1070
Open

kimseongchan0914 wants to merge 1 commit into
jwtk:mainfrom
kimseongchan0914:docs/jwtparser-claims-validation-1070

Conversation

@kimseongchan0914

Copy link
Copy Markdown

Fixes #1070

Summary

The JwtParser.parse Javadoc only mentioned ExpiredJwtException, while DefaultJwtParser also rejects tokens whose nbf is in the future. This PR documents the claims validation that actually happens during parsing:

  • Adds a Claims Validation section to parse(CharSequence) describing:
    • exp → ExpiredJwtException, subject to the configured clock and clock skew
    • nbf → PrematureJwtException, subject to the configured clock and clock skew
    • require* claims → MissingClaimException / IncorrectClaimException
  • Explicitly notes that iat is not validated against the current time. The issue mentions iat, but DefaultJwtParser only checks exp and nbf.
  • Adds the missing @throws PrematureJwtException to parse(CharSequence), parse(CharSequence, JwtHandler) and parseClaimsJws(CharSequence), next to the existing @throws ExpiredJwtException tags.

This is a Javadoc-only change; behavior is unchanged.

Testing

  • ./mvnw -pl api javadoc:javadoc builds without errors.

🤖 Generated with Claude Code

Clarifies that exp and nbf are validated (with clock skew), that
require* claims are asserted, and that iat is not validated. Adds
the missing PrematureJwtException @throws tags.

Fixes jwtk#1070

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Javadoc] The javadoc for JwtParser.parse does not specifically guarantee validation of iat and nbf

1 participant