MEDIUM AI PREVALENCE: MEDIUM auth.csharp.jwt.require-expiration-disabled

A JWT setup sets `RequireExpirationTime = false` on `TokenValidationParameters`.

CWE-613 OWASP API2:2023 C#

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

Tokens without an exp claim are then accepted, so a leaked or stolen token stays valid forever: it can never expire or be timed out (CWE-613). This is a common AI-generated shortcut to accept tokens that happen to omit exp.

Leave RequireExpirationTime at its secure default (true) and keep ValidateLifetime = true so every token must carry an exp claim and is rejected once it lapses.

VULNERABLE

vulnerable.cs

using Microsoft.IdentityModel.Tokens;

public class Startup
{
    public TokenValidationParameters BuildInitializer()
    {
        return new TokenValidationParameters
        {
            ValidateLifetime = true,
            // ruleid: auth.csharp.jwt.require-expiration-disabled
            RequireExpirationTime = false,
        };
    }

    public void BuildAssignment(TokenValidationParameters parameters)
    {
        // ruleid: auth.csharp.jwt.require-expiration-disabled
        parameters.RequireExpirationTime = false;
    }
}

SAFE

safe.cs

using Microsoft.IdentityModel.Tokens;

public class Startup
{
    // Secure default (true) left in place; every token must carry an exp claim.
    public TokenValidationParameters Build()
    {
        return new TokenValidationParameters
        {
            ValidateLifetime = true,
            RequireExpirationTime = true,
        };
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.csharp.jwt.require-expiration-disabled -- <reason>

References

https://learn.microsoft.com/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters.requireexpirationtime ↗https://cwe.mitre.org/data/definitions/613.html ↗

A JWT setup sets RequireExpirationTime = false on TokenValidationParameters.

Why this matters

Suppressing this rule

References

A JWT setup sets `RequireExpirationTime = false` on `TokenValidationParameters`.