Understanding JwT verification - Expiration Time and Signature

[agawronski]

Thank you for your work on the okta-jwt-verifier-php.

I am trying to make sure that I am using this correctly:
https://github.com/okta/okta-jwt-verifier-php#validating-an-access-token

$jwt = $jwtVerifier->verifyAccessToken($jwtString);
• token expiration time
• the time it was issue at
• that the token issuer matches the expected value passed into the above helper
• that the token audience matches the expected value passed into the above helper

I don't see anywhere in the code that actually checks the token expiration time. Am I missing something?

I am also trying to understand where the signature verification occurs.

Thanks,
Aidan.

[arvindkrishnakumar-okta]

Thanks for posting @agawronski !

@bretterer can you please take a look?

[agawronski]

Any luck with this?

Does verifyAccessToken actually secure the app? or just decode the token?