Invalid validation of non-present expiration JWT claims

The validators accepts nullable notBefore and expires DateTimes but return values from JsonWebToken ValidFrom and ValidTo properties return DateTime.MinValue if the claim is not present. So in my opinion JsonWebTokenHandler fails to properly convert it to nullable values.

https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/824068adaeb7b158df2b36d8787f689646e715e0/src/Microsoft.IdentityModel.Tokens/Validators.cs#L330

https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/824068adaeb7b158df2b36d8787f689646e715e0/src/Microsoft.IdentityModel.JsonWebTokens/JsonWebToken.cs#L303-L313

https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/824068adaeb7b158df2b36d8787f689646e715e0/src/Microsoft.IdentityModel.JsonWebTokens/JsonWebTokenHandler.cs#L995-L1000

As a result SecurityTokenNoExpirationException with IDX10225 is never thrown.

The best way to handle this would be to change JsonWebToken results to nullable, but I guess it would be a big breaking change.

Note: the above code snippets are from 6.8.0 branch but dev is at the same state (as of authoring this issue).

[brentschmaltz]

@shadow-cs @GeoK i think consistency between the two handlers would be a good thing. As you suggest @GeoK a simple change to JsonWebTokenHandler should do the trick.

[yori-s]

Any chance this will make it into a 6.8.x?

I’m currently working around with a custom TokenValidationParameters.LifetimeValidator of the form

static bool ValidateLifetime(DateTime? nbf, DateTime? exp, SecurityToken token, TokenValidationParameters tvp)
{
    if (default(DateTime) == nbf) nbf = null;
    if (default(DateTime) == exp) exp = null;

    // undelegate
    var tvp2 = tvp.Clone();
    tvp2.LifetimeValidator = null;
    Validators.ValidateLifetime(nbf, exp, token, tvp2);
    return true;
}

but this feels awkward and brittle.

Also, I’m using JsonWebTokenHandler on 2 different projects and would rather not duplicate the above.