Added leeway for date validation issue #54

Author: JanBrinker

Sources/ClaimSet.swift

@@ -93,18 +93,18 @@ extension ClaimSet {
 // MARK: Validations
 
 extension ClaimSet {
-  public func validate(audience: String? = nil, issuer: String? = nil) throws {
+  public func validate(audience: String? = nil, issuer: String? = nil, leeway: TimeInterval = 0) throws {
     if let issuer = issuer {
       try validateIssuer(issuer)
     }
 
     if let audience = audience {
       try validateAudience(audience)
     }
-
-    try validateExpiary()
-    try validateNotBefore()
-    try validateIssuedAt()
+		
+    try validateExpiary(leeway: leeway)
+    try validateNotBefore(leeway: leeway)
+    try validateIssuedAt(leeway: leeway)
   }
 
   public func validateAudience(_ audience: String) throws {
@@ -131,16 +131,16 @@ extension ClaimSet {
     }
   }
 
-  public func validateExpiary() throws {
-    try validateDate(claims, key: "exp", comparison: .orderedAscending, failure: .expiredSignature, decodeError: "Expiration time claim (exp) must be an integer")
+	public func validateExpiary(leeway: TimeInterval = 0) throws {
+		try validateDate(claims, key: "exp", comparison: .orderedAscending, leeway: (-1 * leeway), failure: .expiredSignature, decodeError: "Expiration time claim (exp) must be an integer")
   }
 
-  public func validateNotBefore() throws {
-    try validateDate(claims, key: "nbf", comparison: .orderedDescending, failure: .immatureSignature, decodeError: "Not before claim (nbf) must be an integer")
+  public func validateNotBefore(leeway: TimeInterval = 0) throws {
+    try validateDate(claims, key: "nbf", comparison: .orderedDescending, leeway: leeway, failure: .immatureSignature, decodeError: "Not before claim (nbf) must be an integer")
   }
 
-  public func validateIssuedAt() throws {
-    try validateDate(claims, key: "iat", comparison: .orderedDescending, failure: .invalidIssuedAt, decodeError: "Issued at claim (iat) must be an integer")
+  public func validateIssuedAt(leeway: TimeInterval = 0) throws {
+    try validateDate(claims, key: "iat", comparison: .orderedDescending, leeway: leeway, failure: .invalidIssuedAt, decodeError: "Issued at claim (iat) must be an integer")
   }
 }
 

Sources/Claims.swift

@@ -1,15 +1,15 @@
 import Foundation
 
-func validateDate(_ payload: Payload, key: String, comparison: ComparisonResult, failure: InvalidToken, decodeError: String) throws {
+func validateDate(_ payload: Payload, key: String, comparison: ComparisonResult, leeway: TimeInterval = 0, failure: InvalidToken, decodeError: String) throws {
   if payload[key] == nil {
     return
   }
 
   guard let date = extractDate(payload: payload, key: key) else {
     throw InvalidToken.decodeError(decodeError)
   }
-
-  if date.compare(Date()) == comparison {
+	
+  if date.compare(Date().addingTimeInterval(leeway)) == comparison {
     throw failure
   }
 }

Sources/Decode.swift

@@ -47,20 +47,20 @@ public enum InvalidToken: CustomStringConvertible, Error {
 
 
 /// Decode a JWT
-public func decode(_ jwt: String, algorithms: [Algorithm], verify: Bool = true, audience: String? = nil, issuer: String? = nil) throws -> ClaimSet {
+public func decode(_ jwt: String, algorithms: [Algorithm], verify: Bool = true, audience: String? = nil, issuer: String? = nil, leeway: TimeInterval = 0) throws -> ClaimSet {
   let (header, claims, signature, signatureInput) = try load(jwt)
 
   if verify {
-    try claims.validate(audience: audience, issuer: issuer)
+		try claims.validate(audience: audience, issuer: issuer, leeway: leeway)
     try verifySignature(algorithms, header: header, signingInput: signatureInput, signature: signature)
   }
 
   return claims
 }
 
 /// Decode a JWT
-public func decode(_ jwt: String, algorithm: Algorithm, verify: Bool = true, audience: String? = nil, issuer: String? = nil) throws -> ClaimSet {
-  return try decode(jwt, algorithms: [algorithm], verify: verify, audience: audience, issuer: issuer)
+public func decode(_ jwt: String, algorithm: Algorithm, verify: Bool = true, audience: String? = nil, issuer: String? = nil, leeway: TimeInterval = 0) throws -> ClaimSet {
+	return try decode(jwt, algorithms: [algorithm], verify: verify, audience: audience, issuer: issuer, leeway: leeway)
 }
 
 /// Decode a JWT