Add decode timezone support

docs/api.rst

@@ -51,6 +51,7 @@ API Reference
             .. deprecated:: 1.2.0
                 Use ``verify_exp`` instead
 
+        * ``timezone`` change the timezone used for decoding and validation, expects tzinfo object
 
     :param iterable audience: optional, the value for ``verify_aud`` check
     :param str issuer: optional, the value for ``verify_iss`` check

jwt/api_jwt.py

@@ -1,7 +1,7 @@
 import json
 from calendar import timegm
 from collections.abc import Iterable, Mapping
-from datetime import datetime, timedelta
+from datetime import datetime, timedelta, timezone
 
 from .algorithms import Algorithm, get_default_algorithms  # NOQA
 from .api_jws import PyJWS
@@ -36,6 +36,7 @@ def _get_default_options():
             "verify_iat": True,
             "verify_aud": True,
             "verify_iss": True,
+            "timezone": timezone.utc,   # type: tzinfo
             "require": [],
         }
 
@@ -132,7 +133,7 @@ def _validate_claims(
 
         self._validate_required_claims(payload, options)
 
-        now = timegm(datetime.utcnow().utctimetuple())
+        now = timegm(datetime.now(tz=options.get("timezone")).utctimetuple())
 
         if "iat" in payload and options.get("verify_iat"):
             self._validate_iat(payload, now, leeway)

setup.cfg

@@ -43,6 +43,7 @@ tests =
     pytest>=6.0.0,<7.0.0
     coverage[toml]==5.0.4
     requests-mock>=1.7.0,<2.0.0
+    pytz >= 2020.1
 dev =
     sphinx
     sphinx-rtd-theme

tests/test_api_jwt.py

@@ -5,6 +5,7 @@
 from decimal import Decimal
 
 import pytest
+import pytz
 
 from jwt.api_jwt import PyJWT
 from jwt.exceptions import (
@@ -588,6 +589,29 @@ def test_decode_with_verify_exp_option(self, jwt, payload):
                 options={"verify_exp": True},
             )
 
+    def test_decode_with_timezone_and_verify_exp_options(self, jwt, payload):
+        timezone = pytz.timezone('US/Pacific')
+        current_time = timegm(datetime.now(tz=timezone).utctimetuple())
+        payload["iat"] = current_time
+        payload["exp"] = current_time - 1
+        secret = "secret"
+        jwt_message = jwt.encode(payload, secret)
+
+        jwt.decode(
+            jwt_message,
+            secret,
+            algorithms=["HS256"],
+            options={"timezone": timezone, "verify_exp": False},
+        )
+
+        with pytest.raises(ExpiredSignatureError):
+            jwt.decode(
+                jwt_message,
+                secret,
+                algorithms=["HS256"],
+                options={"timezone": timezone, "verify_exp": True,},
+            )
+
     def test_decode_with_optional_algorithms(self, jwt, payload):
         secret = "secret"
         jwt_message = jwt.encode(payload, secret)