v3.4.2 Possible incorrect implementation of 4.1.4 from RFC 7519

[anikeevda]

According to RFC, The processing of the "exp" claim requires that the current date/time MUST be before the expiration date/time listed in the "exp" claim.. So current_time < exp translates into valid token and current_time >= exp into invalid token . In Factory constructor exp validation made with 'exp' => [$this, 'createGreaterOrEqualsTo'] which seems to be correct while In Token class method isExpired implemented as

$now = $now ?: new DateTimeImmutable();
return $now > $this->claims->get(RegisteredClaims::EXPIRATION_TIME);

Does this is correct solution and maybe comparison shoud be made as ?

$now = $now ?: new DateTimeImmutable();
return $now >= $this->claims->get(RegisteredClaims::EXPIRATION_TIME);

[vitovtnet]

Agree with @anikeevda - we have a lot of problems with these validations.

[lcobucci]

Released in https://github.com/lcobucci/jwt/releases/tag/3.4.3 👍