Validate jwt token expiration

nyxx-discord · Dec 14, 2024 · e9c51d8 · e9c51d8
1 parent ee11350
commit e9c51d8
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/lib/src/web_app/jwt.dart b/lib/src/web_app/jwt.dart
@@ -61,6 +61,10 @@ shelf.Middleware processJwt(List<JwtPermission> permissions) => (innerHandler) {
           return createUnauthorizedResponse("Invalid jwt token");
         }
 
+        if (claim.expiry?.isBefore(DateTime.now()) ?? true) {
+          return createUnauthorizedResponse("Token expired");
+        }
+
         final permissions = Set.of(claim.payload['permissions'] ?? []);
         if (!permissions.containsAll(permissionsIntValues)) {
           return createForbiddenResponse("Missing permissions");