0Pricing
Spring Security 6 & JWT Authentication · Lesson

JWT Expiration and Validation Rules

Understand how JWT lifetime is controlled with time-based claims like exp, nbf, and iat, and how validators reject expired or premature tokens.

JWT Expiration and Validation Rules is a free Spring Security 6 & JWT Authentication lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Spring Security 6 & JWT Authentication learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Tokens Need a Lifetime

A JWT is a bearer credential: whoever holds it is trusted. If a token never expired, a leaked token would grant access forever.

Time-based claims limit the damage window by making tokens valid only for a short period.

The exp Claim

The exp (expiration) claim is a Unix timestamp. After this moment the token is invalid and must be rejected.

{
  'sub': 'user123',
  'exp': 1717200000
}

The iat Claim

The iat (issued at) claim records when the token was created. It is useful for measuring token age and for revoking all tokens issued before a certain time.

{
  'sub': 'user123',
  'iat': 1717196400,
  'exp': 1717200000
}

The nbf Claim

The nbf (not before) claim defines the earliest time a token becomes valid. A token used before its nbf time must be rejected, which is handy for tokens scheduled to activate later.

{
  'sub': 'user123',
  'nbf': 1717196400,
  'exp': 1717200000
}

Choosing an Expiration Window

Short lifetimes are safer but force frequent re-authentication. A common pattern is:

  • Access token: 5-15 minutes
  • Refresh token: days or weeks

The short access token limits exposure; the refresh token keeps the user logged in.

Setting exp When Issuing

When you build a token, set exp relative to now. Here a 15-minute access token is created using a JWT library.

const now = Math.floor(Date.now() / 1000);
const payload = {
  sub: 'user123',
  iat: now,
  exp: now + 15 * 60
};

Validating exp on the Server

On every request the server checks exp against the current time. Most libraries do this automatically and throw if the token is expired.

try {
  const claims = verify(token, secret);
} catch (err) {
  if (err.name === 'TokenExpiredError') {
    // reject with 401
  }
}

Clock Skew

Servers do not always have perfectly synchronized clocks. A small leeway (a few seconds) prevents valid tokens from being rejected because of minor clock differences.

verify(token, secret, { clockTolerance: 5 });

exp Is Not Encryption

Remember: a JWT payload is only encoded, not encrypted. The exp claim stops the server from accepting the token, but anyone can read the claims. Never put secrets in the payload.

Reacting to Expiry on the Client

When the client gets a 401 due to expiry, it should silently request a new access token using the refresh token, then retry the original request.

if (response.status === 401) {
  const fresh = await refreshAccessToken();
  return retryWith(fresh);
}

Common Validation Mistakes

Watch out for these errors:

  • Forgetting to validate exp at all
  • Using milliseconds instead of seconds for the timestamp
  • Setting an excessively long lifetime
  • Ignoring nbf, allowing premature use

Quick Check

Test your knowledge of JWT time claims.

Recap

You learned how JWT lifetime is controlled:

  • exp sets the expiration; iat records issue time; nbf sets earliest validity
  • Use short access tokens plus longer refresh tokens
  • Allow small clock skew with leeway
  • exp does not encrypt the payload

Proper expiration handling keeps stolen tokens useful for only a brief window.

Frequently asked questions

Is the “JWT Expiration and Validation Rules” lesson free?

Yes — the full text of “JWT Expiration and Validation Rules” is free to read here on the web, and the Spring Security 6 & JWT Authentication course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Spring Security 6 & JWT Authentication course, upgrade to CoddyKit PRO.

What will I learn in “JWT Expiration and Validation Rules”?

Understand how JWT lifetime is controlled with time-based claims like exp, nbf, and iat, and how validators reject expired or premature tokens. You practise Spring Security 6 & JWT Authentication with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Spring Security 6 & JWT Authentication?

No prior experience is required. Spring Security 6 & JWT Authentication on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “JWT Expiration and Validation Rules” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Spring Security 6 & JWT Authentication lesson?

Yes. Every Spring Security 6 & JWT Authentication lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Understanding JSON Web Tokens
  2. JWT Structure and Claims
  3. Signing and Verifying JWTs
  4. JWT Expiration and Validation Rules
← Back to Spring Security 6 & JWT Authentication