Skip to content

Commit

Permalink
fix: accept float claims but round down to ignore them (#492)
Browse files Browse the repository at this point in the history
  • Loading branch information
croensch authored Jun 28, 2023
1 parent 48b0210 commit 3936842
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions src/JWT.php
Original file line number Diff line number Diff line change
Expand Up @@ -152,18 +152,18 @@ public static function decode(

// Check the nbf if it is defined. This is the time that the
// token can actually be used. If it's not yet that time, abort.
if (isset($payload->nbf) && $payload->nbf > ($timestamp + static::$leeway)) {
if (isset($payload->nbf) && floor($payload->nbf) > ($timestamp + static::$leeway)) {
throw new BeforeValidException(
'Cannot handle token prior to ' . \date(DateTime::ISO8601, $payload->nbf)
'Cannot handle token prior to ' . \date(DateTime::ISO8601, (int) $payload->nbf)
);
}

// Check that this token has been created before 'now'. This prevents
// using tokens that have been created for later use (and haven't
// correctly used the nbf claim).
if (!isset($payload->nbf) && isset($payload->iat) && $payload->iat > ($timestamp + static::$leeway)) {
if (!isset($payload->nbf) && isset($payload->iat) && floor($payload->iat) > ($timestamp + static::$leeway)) {
throw new BeforeValidException(
'Cannot handle token prior to ' . \date(DateTime::ISO8601, $payload->iat)
'Cannot handle token prior to ' . \date(DateTime::ISO8601, (int) $payload->iat)
);
}

Expand Down

0 comments on commit 3936842

Please sign in to comment.