VerifyJWS nbf check not working

[LBG_User]

We are using verifyjws policy and wanted to validated access-token. it is working as expected but we have recently introduced a claim called nbf . we are using as described in https://docs.apigee.com/api-platform/reference/policies/verify-jws-policy valid variable but in all cases these variable is getting true whereas for future nbf is should false. attache screen shot. 

could you please help me with the fix, this seems product issue. we are using apigeex 

[dchiesa1 · Accepted solution]

DecodeJWT is showing you a nbf claim that is ~10 years in the future. But VerifyJWS is succeeding. What's up?  

tl/dr: VerifyJWS does not examine the claims in the payload. 

You are doing two things. 

• DecodeJWT to examine the claims in ... what appears to be a JWT
• VerifyJWS to verify the signature over that payload. It works, despite the nbf being in the future.

But VerifyJWS does not verify JWT claims!  If you want to verify JWT claims, then you need to use VerifyJWT.  

A signed JWT is also a JWS. So you can use VerifyJWS on a JWT, and it will simply check the algorithm and signature.  Nothing else.  

If you want to check validity date claims like exp and nbf, or check the max lifetime of the JWT, or check other claims, then you need to use VerifyJWT. 

solution: use VerifyJWT to verify your JWT.