Skip to content
Sarj Sarj Sarj Standards

require-exp-on-jwt-decode

PyJWT decode calls require the exp claim.

SARJ504 Rule source Tests Catalog JSON

Why

PyJWT validates exp only when the claim is present. A token minted without exp (for example by a helper whose lifetime defaults to None) passes verification forever. RFC 8725 tells verifiers to enforce the claims they rely on rather than trust the minter.

Fix

Pass options={"require": ["exp"]} to jwt.decode and bound the accepted lifetime.

Examples

Before — flagged A token without exp is accepted
auth.py
import jwt




def claims(token: str, key: str) -> dict[str, object]:
    return jwt.decode(token, key, algorithms=["HS256"])
After — preferred The verifier requires exp
auth.py
import jwt




def claims(token: str, key: str) -> dict[str, object]:
    return jwt.decode(token, key, algorithms=["HS256"], options={"require": ["exp"]})