added validation of token expiration, issuedAt and nbf (#387)

v2/auth/jwt.go

@@ -12,10 +12,28 @@ func IsTokenValid(token string, tokenExpireDurationDiff time.Duration) bool {
 		return false
 	}
 
-	parser := jwt.NewParser(jwt.WithLeeway(tokenExpireDurationDiff))
-
 	var claims jwt.RegisteredClaims
 
-	_, _, err := parser.ParseUnverified(token, &claims)
-	return err == nil
+	_, _, err := jwt.NewParser().ParseUnverified(token, &claims)
+	if err != nil {
+		return false
+	}
+
+	ts := time.Now().Add(tokenExpireDurationDiff)
+
+	for _, claim := range []*jwt.NumericDate{
+		claims.ExpiresAt,
+		claims.IssuedAt,
+		claims.NotBefore,
+	} {
+		if claim == nil {
+			continue
+		}
+
+		if claim.Before(ts) {
+			return false
+		}
+	}
+
+	return true
 }