Token.validate compares ext and nbf with > / <. Python json.loads accepts NaN and Infinity by default. Those comparisons are always false, so ext: Infinity never expires and nbf: NaN never blocks use. A string such as "never" raises TypeError instead of DIDTokenMalformed.
Language-split of magiclabs/magic-admin-js#156.
Happy to open a PR that fail-closes on non-finite iat / ext / nbf.
Token.validatecomparesextandnbfwith>/<. Pythonjson.loadsacceptsNaNandInfinityby default. Those comparisons are always false, soext: Infinitynever expires andnbf: NaNnever blocks use. A string such as"never"raisesTypeErrorinstead ofDIDTokenMalformed.Language-split of magiclabs/magic-admin-js#156.
Happy to open a PR that fail-closes on non-finite
iat/ext/nbf.