make payload.exp and options.expiresIn exclusive

index.js

@@ -66,6 +66,9 @@ JWT.sign = function(payload, secretOrPrivateKey, options, callback) {
     }
   }
 
+  if (typeof payload.exp !== 'undefined' && typeof options.expiresIn !== 'undefined') {
+    throw new Error('Bad "options.expiresIn" option the payload already has an "exp" property.');
+  }
 
   header.alg = options.algorithm || 'HS256';
 

test/async_sign.tests.js

@@ -10,6 +10,7 @@ describe('signing a token asynchronously', function() {
 
     it('should return the same result as singing synchronously', function(done) {
       jwt.sign({ foo: 'bar' }, secret, { algorithm: 'HS256' }, function (err, asyncToken) {
+        if (err) return done(err);
         expect(asyncToken).to.be.a('string');
         expect(asyncToken.split('.')).to.have.length(3);
         expect(asyncToken).to.equal(syncToken);

test/expires_format.tests.js

@@ -36,4 +36,10 @@ describe('expires option', function() {
     }).to.throw(/"expiresIn" should be a number of seconds or string representing a timespan/);
   });
 
-});
+  it('should throw an error if expiresIn and exp are provided', function () {
+    expect(function () {
+      jwt.sign({ foo: 123, exp: 839218392183 }, '123', { expiresIn: '5h' });
+    }).to.throw(/Bad "options.expiresIn" option the payload already has an "exp" property./);
+  });
+
+});