Validators

After verifying and extracting the payloads from the token, but before returning the object representation of the payload to the user, library authors may wish to add the ability for their token parsers to automatically validate the token against some basic constraints.

This is not strictly required, but validation support is highly recommended.

Some examples of validation rules that libraries may wish to provide include:

• ForAudience which compares the payload-provided aud claim with an expected value.
• IdentifiedBy which compares the payload-provided jti claim with an expected value.
• IssuedBy which compares the payload-provided iss claim with an expected value.
• NotExpired which verifies that the current time is less than or equal to the DateTime stored in the exp claim.
• Subject which compares the payload-provided sub claim with an expected value.
• ValidAt which verifies all of the following:
  • The current time is less than or equal to the DateTime stored in the exp claim.
  • The current time is greater than or equal to the DateTime stored in the iat claim.
  • The current time is greater than or equal to the DateTime stored in the nbf claim.

Example implementations of these validators are included in the PHP implementation.

Validation should fail-closed by default (e.g., if invalid data is provided).