Expiration time not being checked if exp field does not exist

Get Help
3

Hi @ayush.parwal,

Welcome to the Auth0 Community!

Firstly, JWT tokens are immutable and the exp claim is part of the JWT reserved claims that are not required, but are recommended to allow operability with third-party-apps. (Reference: JSON Web Token Claims)

Is there a reason why you have decided to remove the exp claim? In general, you should keep the exp claim.

Additionally, could you confirm if you removed the exp claim after the JWT has been signed and issued?

Thanks,
Rueben