Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.
Why this matters
With the lifetime unchecked, expired tokens are accepted forever, so a leaked or revoked token never stops working and cannot be timed out (CWE-613). This is a common AI-generated shortcut: expiry checks are turned off to stop a short-lived test token from failing and then left disabled.
Leave ValidateLifetime at its secure default (true) so the exp (and nbf) claims are enforced. If clock drift is the real problem, set a small ClockSkew instead of disabling the check.
VULNERABLE
vulnerable.cs
using Microsoft.AspNetCore.Authentication.JwtBearer;using Microsoft.Extensions.DependencyInjection;using Microsoft.IdentityModel.Tokens;public class Startup{ public void ConfigureServices(IServiceCollection services) { services.AddAuthentication().AddJwtBearer(options => { options.TokenValidationParameters = new TokenValidationParameters { ValidateIssuer = true, ValidateAudience = true, // ruleid: auth.csharp.jwt.validate-lifetime-disabled ValidateLifetime = false, }; }); }}
SAFE
safe.cs
using Microsoft.AspNetCore.Authentication.JwtBearer;using Microsoft.Extensions.DependencyInjection;using Microsoft.IdentityModel.Tokens;public class Startup{ // An OIDC framework validates the token lifetime itself, outside any JWT // bearer registration. Disabling the built-in check here is deliberate, so // it must NOT fire (no AddJwtBearer context). public static readonly TokenValidationParameters FrameworkDefaults = new TokenValidationParameters { ValidateLifetime = false, }; public void ConfigureServices(IServiceCollection services) { services.AddAuthentication().AddJwtBearer(options => { options.TokenValidationParameters = new TokenValidationParameters { ValidateLifetime = true, ClockSkew = System.TimeSpan.Zero, }; }); }}
Suppressing this rule
If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.