The documentation for the Oauth2 Resource Server validation (https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#oauth2resourceserver-validation) contain a remark that the default configuration of **30 seconds** clock is configured. Two remarks on this: 1. The current implemented default seems to **60 seconds** [JwtTimestampValidator](https://github.com/spring-projects/spring-security/blob/master/oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/JwtTimestampValidator.java) Either the documenation or the code need be changed. 2. When using the spring boot starter, a configuration property to change the default might make sense.