Merge pull request #28 from zgiber/fix-iat-validation
use GetTime when validating "iat" claim
diff --git a/jwt/jwt.go b/jwt/jwt.go
index d29c43a..feb1712 100644
--- a/jwt/jwt.go
+++ b/jwt/jwt.go
@@ -59,9 +59,10 @@
j.Claims().Get("sub") != sub {
return ErrInvalidSUBClaim
}
- if iat, ok := v.Expected.IssuedAt(); ok &&
- j.Claims().Get("iat") != iat {
- return ErrInvalidIATClaim
+ if iat, ok := v.Expected.IssuedAt(); ok {
+ if t, ok := j.Claims().GetTime("iat"); !t.Equal(iat) || !ok {
+ return ErrInvalidIATClaim
+ }
}
if jti, ok := v.Expected.JWTID(); ok &&
j.Claims().Get("jti") != jti {
