Spring Security 6 & JWT Authentication · Lesson

JWT Expiration and Validation Rules

Understand how JWT lifetime is controlled with time-based claims like exp, nbf, and iat, and how validators reject expired or premature tokens.

Why Tokens Need a Lifetime

A JWT is a bearer credential: whoever holds it is trusted. If a token never expired, a leaked token would grant access forever.

Time-based claims limit the damage window by making tokens valid only for a short period.

The exp (expiration) claim is a Unix timestamp. After this moment the token is invalid and must be rejected.

{
  'sub': 'user123',
  'exp': 1717200000
}