IssuedAt claim is not verified when jwt.WithIssuedAt() option is given to Parser

[ahola-ookla]

In jwt/validator.go, the validation logic for IssuedAt is:

	// Check issued-at if the option is enabled
	if v.verifyIat {
		if err = v.verifyIssuedAt(claims, now, false); err != nil {
			errs = append(errs, err)
		}
	}

Because the last parameter to v.verifyIssuedAt(claims, now, false) is false, IssuedAt is not verified even if v.verifyIat is true.

The correct logic is to use v.verifyIssuedAt(claims, now, true).

[oxisto]

Do you have an example where this would occur? The third parameter only check if is is REQUIRED, so currently the behaviour is that it will check the IAT, if its in the token. We can think about a similar solution as with NBF, where if I am not mistaken we have two options, one for the check and one for whether it is required or not.

[ahola-ookla]

When a token is parsed like this:

token, err := jwt.Parse(tokenString, keyfunc,
    jwt.WithAudience(expectedAudience),
    jwt.WithIssuer(expectedIssuer),
    jwt.WithExpirationRequired(),
    jwt.WithIssuedAt())

The aud, iss and exp are required but iat is optional. In this example, iat should be required like the other claims. The api does not have any way to make iat required.

[oxisto]

When a token is parsed like this:

token, err := jwt.Parse(tokenString, keyfunc,
    jwt.WithAudience(expectedAudience),
    jwt.WithIssuer(expectedIssuer),
    jwt.WithExpirationRequired(),
    jwt.WithIssuedAt())

The aud, iss and exp are required but iat is optional. In this example, iat should be required like the other claims. The api does not have any way to make iat required.

Can you please prepare a pull request that implements that desired change (including possible test adjustments)? Then we can discuss the options in that pull request. Thank you!