v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: HIGH auth.jwt.ignore-expiration

ignoreExpiration: true in a jsonwebtoken verify() call disables the exp claim check.

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

An expired token is then accepted as valid forever, so a stolen or long-old token never stops working, defeating the whole point of short-lived access tokens.

Remove ignoreExpiration: true so the exp claim is enforced, and set a sane expiresIn when signing (jwt.sign(payload, key, { expiresIn: '15m' })). See CWE-613 (Insufficient Session Expiration).

VULNERABLE
vulnerable.ts
import jwt from 'jsonwebtoken';
import { verify } from 'jsonwebtoken';

declare const token: string;
declare const key: string;

// ruleid: auth.jwt.ignore-expiration
const a = jwt.verify(token, key, { ignoreExpiration: true });

// ruleid: auth.jwt.ignore-expiration
const b = jwt.verify(token, key, { algorithms: ['RS256'], ignoreExpiration: true });

// ruleid: auth.jwt.ignore-expiration
const c = jwt.verify(token, key, { ignoreExpiration: true, audience: 'api' });

// ruleid: auth.jwt.ignore-expiration
const d = verify(token, key, { ignoreExpiration: true });

export { a, b, c, d };
SAFE
safe.ts
import jwt from 'jsonwebtoken';
import { decode } from 'jsonwebtoken';

declare const token: string;
declare const key: string;

// ok: auth.jwt.ignore-expiration -- exp is enforced (no ignoreExpiration option)
const a = jwt.verify(token, key, { algorithms: ['RS256'] });

// ok: auth.jwt.ignore-expiration -- maxAge tightens expiry rather than disabling it
const b = jwt.verify(token, key, { maxAge: '2h' });

// ok: auth.jwt.ignore-expiration -- ignoreExpiration explicitly false keeps the exp check
const c = jwt.verify(token, key, { ignoreExpiration: false });

// ok: auth.jwt.ignore-expiration -- a bare verify with no options object
const d = jwt.verify(token, key);

// ok: auth.jwt.ignore-expiration -- decode is a different jsonwebtoken API, out of scope
const e = decode(token);

export { a, b, c, d, e };

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.jwt.ignore-expiration -- <reason>

References

https://github.com/auth0/node-jsonwebtoken#jwtverifytoken-secretorpublickey-options-callback ↗https://cwe.mitre.org/data/definitions/613.html ↗