Move nbf and exp verifications after signature verification.

[alexjab]

Hi,

I would like to move the signature validation before the check of exp and nbf claims.

I have the following scenario, which I believe is quite common: I sign tokens with an expiration date, but I want my system to be able to refresh them (i.e. re-emit a new one with the data of the old one, but with a later expiration date) if the expiration date was near AND the token passed validation. Currently I can't, because an expiration error will be thrown before the actual validation.

To do that, we need the token to be validated first, and then its expiration checked. People that don't want to use expiration, can just opt-out and not put any exp flag, as usual. This should not change anything for the rest of the users, and allow a new interesting use case.

Please tell me if there is an issue I did not think of.

[hokaccha]

It looks good. Could you check CI is failing?

[alexjab]

Looks like it was a mismatch between the version in package.json and in the code.

[hokaccha]

LGTM