[Feature Request] Allow to disable the addition of nbf claim

[augustozanellato]

I'm working on a mobile application and I'm having some issues validating tokens client side because of clock skew and the nbf claim, I suggest to add a configuration flag which disables its addition.

[vimalloc]

In the upcoming 4.0.0 release, this extension moves all additional claims to the top level, which lets you override default claims like nbf. Would using this feature to set the nbf value to null fix the issue you are seeing? If it can be accomplished that way it would be probably easier then adding an additional setting just for nbf.

It would look something like:

create_access_token(identity, additional_claims={"nbf": None})

[augustozanellato]

That would be sort of fine, but I think it should be at least possible to set a default additional_claims so that I can provide a None nbf (or some other default value for some other claim) without having to specify it in all the places where I generate a token.

[vimalloc]

You can do it via a decorator as well. For example this would work the exact same way:

@jwt.additional_claims_loader
def custom_jwt_claims(identity):
    return {"nbf": None}

And the results of that decorator will be merged with anything passed in to additional_claims. For example:

create_access_token(identity, additional_claims={"foo": "bar"})
# Results in a token with {"nbf": None, "foo": "bar"}

create_access_token(identity, additional_claims={"nbf": 12345})
# tie goes to the additional_claims arguments, which results in {"nbf": 12345}

[augustozanellato]

That would be awesome!

[vimalloc-mavenlink]

Perfect! Everything is setup in 4.0.0 to handle this then. I'm going to close this issue for now, keep an eye out for 4.0.0 in the coming weeks 👍

[augustozanellato]

Hi, just become aware that 4.0.0 has been released, I tried the suggested solutions but something fails in pyjwt when nbf is None, see attached stack trace

  File "/Users/augustozanellato/Library/Caches/pypoetry/virtualenvs/memolight-backend-QjfkMkQQ-py3.9/lib/python3.9/site-packages/flask_jwt_extended/view_decorators.py", line 114, in decorator
    verify_jwt_in_request(optional, fresh, refresh, locations)
  File "/Users/augustozanellato/Library/Caches/pypoetry/virtualenvs/memolight-backend-QjfkMkQQ-py3.9/lib/python3.9/site-packages/flask_jwt_extended/view_decorators.py", line 66, in verify_jwt_in_request
    jwt_data, jwt_header = _decode_jwt_from_request("access", locations, fresh)
  File "/Users/augustozanellato/Library/Caches/pypoetry/virtualenvs/memolight-backend-QjfkMkQQ-py3.9/lib/python3.9/site-packages/flask_jwt_extended/view_decorators.py", line 260, in _decode_jwt_from_request
    decoded_token = decode_token(encoded_token, csrf_token)
  File "/Users/augustozanellato/Library/Caches/pypoetry/virtualenvs/memolight-backend-QjfkMkQQ-py3.9/lib/python3.9/site-packages/flask_jwt_extended/utils.py", line 106, in decode_token
    return jwt_manager._decode_jwt_from_config(encoded_token, csrf_value, allow_expired)
  File "/Users/augustozanellato/Library/Caches/pypoetry/virtualenvs/memolight-backend-QjfkMkQQ-py3.9/lib/python3.9/site-packages/flask_jwt_extended/jwt_manager.py", line 528, in _decode_jwt_from_config
    return _decode_jwt(**kwargs, allow_expired=allow_expired)
  File "/Users/augustozanellato/Library/Caches/pypoetry/virtualenvs/memolight-backend-QjfkMkQQ-py3.9/lib/python3.9/site-packages/flask_jwt_extended/tokens.py", line 84, in _decode_jwt
    decoded_token = jwt.decode(
  File "/Users/augustozanellato/Library/Caches/pypoetry/virtualenvs/memolight-backend-QjfkMkQQ-py3.9/lib/python3.9/site-packages/jwt/api_jwt.py", line 113, in decode
    decoded = self.decode_complete(jwt, key, algorithms, options, **kwargs)
  File "/Users/augustozanellato/Library/Caches/pypoetry/virtualenvs/memolight-backend-QjfkMkQQ-py3.9/lib/python3.9/site-packages/jwt/api_jwt.py", line 100, in decode_complete
    self._validate_claims(payload, merged_options, **kwargs)
  File "/Users/augustozanellato/Library/Caches/pypoetry/virtualenvs/memolight-backend-QjfkMkQQ-py3.9/lib/python3.9/site-packages/jwt/api_jwt.py", line 133, in _validate_claims
    self._validate_nbf(payload, now, leeway)
  File "/Users/augustozanellato/Library/Caches/pypoetry/virtualenvs/memolight-backend-QjfkMkQQ-py3.9/lib/python3.9/site-packages/jwt/api_jwt.py", line 157, in _validate_nbf
    nbf = int(payload["nbf"])

[vimalloc]

Well darn, that does complicate things. I'll get something setup here so you can actually disable the NBF time. In the mean time, you could work around this by doing something like this:

from datetime import datetime
from datetime import timedelta
from datetime import timezone

@jwt.additional_claims_loader
def custom_jwt_claims(identity):
    custom_nbf = datetime.now(timezone.utc) - timedelta(weeks=300)
    return {"nbf": custom_nbf}

[vimalloc]

Thanks to @magnunleno, this can now be properly removed with the JWT_ENCODE_NBF option! I'll get a new release with this functionality included pushed out soon.