v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: HIGH auth.jwt.no-expiration

JWT is signed without any expiresIn / exp claim, OR a token is verified without an maxAge check.

Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.

Why this matters

A stolen token therefore remains valid forever.

Always set a reasonable expiration on access tokens (5-60 minutes is typical) and verify it with { maxAge: '15m' } or by validating the exp claim explicitly.

VULNERABLE
vulnerable.ts
import jwt from 'jsonwebtoken';

// ruleid: auth.jwt.no-expiration
export const noExp = jwt.sign({ uid: 1 }, process.env.JWT_SECRET!);

// ruleid: auth.jwt.no-expiration
export const noExp2 = jwt.sign({ uid: 2, role: 'admin' }, process.env.JWT_SECRET!, {
  algorithm: 'HS256',
});
SAFE
safe.ts
import jwt from 'jsonwebtoken';

// ok: auth.jwt.no-expiration
export const accessToken = jwt.sign({ uid: 1 }, process.env.JWT_SECRET!, {
  expiresIn: '15m',
});

// ok: auth.jwt.no-expiration
export const refreshToken = jwt.sign(
  { uid: 1, exp: Math.floor(Date.now() / 1000) + 3600 },
  process.env.JWT_SECRET!,
);

// ok: auth.jwt.no-expiration -- exp in payload with an options object (3-arg form)
export const withExpAndOpts = jwt.sign(
  { uid: 1, exp: Math.floor(Date.now() / 1000) + 3600 },
  process.env.JWT_SECRET!,
  { algorithm: 'HS256' },
);

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.jwt.no-expiration -- <reason>

References

https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.4 ↗