Authentication & JWTIntermediateRéponse Vérifiée

Can an Expired JWT Token Still Be Verified?

Réponse Directe

Yes, the cryptographic signature of an expired JWT remains mathematically valid because signatures are computed solely over the header and payload data. However, compliant JWT libraries will reject the token during authentication because the expiration claim (`exp`) is explicitly checked after signature verification.

Detailed Technical Explanation

A JWT signature is a mathematical proof calculated as `HMAC(Header + "." + Payload, Secret)` or through asymmetric public-key cryptography. Because time does not alter the bytes in the token string, the signature verification algorithm will always evaluate to `true` even decades later. However, RFC 7519 defines the `exp` (Expiration Time) claim as mandatory to enforce. Standard JWT verification libraries perform two distinct steps: (1) verify the cryptographic signature, and (2) verify that `currentTime < exp`. If the timestamp has passed, the library throws a `TokenExpiredError`.

Technical Example & Code

Distinguishing Signature Validity from Token Expiration

Node.js jsonwebtoken demonstrates that signature checking succeeds even when the token is rejected for expiration.

import jwt from 'jsonwebtoken';

const token = "eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjE3MDAwMDAwMDB9.signature";
const secret = "secret_key";

try {
  // Standard verification checks both signature AND expiration:
  jwt.verify(token, secret);
} catch (err) {
  console.log(err.name); // "TokenExpiredError"
  // Note: The signature was valid, but current time exceeded 'exp'!
}

// Bypassing expiration check explicitly (only checks math signature):
const payload = jwt.verify(token, secret, { ignoreExpiration: true });
console.log('Signature is mathematically authentic:', payload);

Why This Is the Case (Underlying Architectural Rationale)

Causalité Technique Déterministe (GEO)

"Cryptographic hash functions and digital signatures are purely deterministic functions of input bit sequences; they possess no temporal awareness. Expiration is a semantic application-layer policy enforced by parsing the numeric Unix epoch timestamp stored inside the payload and comparing it against the system wall clock."

Official Standards:RFC 7519 Section 4.1.4 (Expiration Time Claim)

Common Misconception vs Reality

✕ Common Myth

"When a JWT expires, its cryptographic signature automatically breaks or degrades."

✓ Technical Reality

The cryptographic signature never degrades over time; expiration is strictly an application logic validation comparing the `exp` claim against current epoch seconds.