v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: MEDIUM auth.passport.jwt-ignore-expiration

A passport-jwt strategy is configured with ignoreExpiration: true.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

This disables the exp claim check, so the strategy authenticates expired tokens forever. A leaked or long-old JWT then never stops working, defeating short-lived access tokens. Remove ignoreExpiration: true (the default is false, which enforces exp) and issue tokens with a short lifetime. See CWE-613 (Insufficient Session Expiration).

VULNERABLE
vulnerable.ts
import { Strategy as JwtStrategy, ExtractJwt } from 'passport-jwt';
import passport from 'passport';

declare const verify: (payload: unknown, done: unknown) => void;

// ruleid: auth.passport.jwt-ignore-expiration
passport.use(
  new JwtStrategy(
    {
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      secretOrKey: process.env.JWT_SECRET,
      ignoreExpiration: true,
    },
    verify,
  ),
);

// ruleid: auth.passport.jwt-ignore-expiration
const strategy = new JwtStrategy(
  {
    jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
    ignoreExpiration: true,
    secretOrKey: process.env.JWT_SECRET,
  },
  verify,
);

export { strategy };
SAFE
safe.ts
import { Strategy as JwtStrategy, ExtractJwt } from 'passport-jwt';
import passport from 'passport';

declare const verify: (payload: unknown, done: unknown) => void;

// ok: auth.passport.jwt-ignore-expiration -- expiry enforced (default)
passport.use(
  new JwtStrategy(
    {
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      secretOrKey: process.env.JWT_SECRET,
    },
    verify,
  ),
);

// ok: auth.passport.jwt-ignore-expiration -- explicitly false, expiry enforced
const strategy = new JwtStrategy(
  {
    jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
    ignoreExpiration: false,
    secretOrKey: process.env.JWT_SECRET,
  },
  verify,
);

// ok: auth.passport.jwt-ignore-expiration -- unrelated library, not passport-jwt
const pollerOptions = {
  ignoreExpiration: true,
};

export { strategy, pollerOptions };

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.passport.jwt-ignore-expiration -- <reason>

References

https://www.passportjs.org/packages/passport-jwt/ ↗https://cwe.mitre.org/data/definitions/613.html ↗