diff --git a/validator.go b/validator.go index 008ecd87..150f5c2c 100644 --- a/validator.go +++ b/validator.go @@ -112,11 +112,10 @@ func (v *Validator) Validate(claims Claims) error { errs = append(errs, err) } - // Check issued-at if the option is enabled - if v.verifyIat { - if err = v.verifyIssuedAt(claims, now, false); err != nil { - errs = append(errs, err) - } + // Check issued-at if the option is enabled, but usage of the claim + // itself is OPTIONAL. + if err = v.verifyIssuedAt(claims, now, v.verifyIat); err != nil { + errs = append(errs, err) } // If we have an expected audience, we also require the audience claim diff --git a/validator_test.go b/validator_test.go index 08a6bd71..f57f5982 100644 --- a/validator_test.go +++ b/validator_test.go @@ -231,17 +231,23 @@ func Test_Validator_verifyIssuedAt(t *testing.T) { }{ { name: "good claim without iat", - fields: fields{verifyIat: true}, + fields: fields{verifyIat: false}, args: args{claims: MapClaims{}, required: false}, wantErr: nil, }, + { + name: "bad claim without iat", + fields: fields{verifyIat: true}, + args: args{claims: MapClaims{}, required: true}, + wantErr: ErrTokenRequiredClaimMissing, + }, { name: "good claim with iat", fields: fields{verifyIat: true}, args: args{ claims: RegisteredClaims{IssuedAt: NewNumericDate(time.Now())}, cmp: time.Now().Add(10 * time.Minute), - required: false, + required: true, }, wantErr: nil, },