Remove "not before" claim "nbf" from JWT access token

[jbman]

A Hydra JWT access token contains the “not before” claim with the same value as “issued at”.
Example:
{
“exp”: 1565861736,
“iat”: 1565858136,
“nbf”: 1565858136,
…
}

This could lead to failing validations, if a resource server hasn’t the correct time set or has some seconds clock skew which but strict “not before” validation.
In addition, I think there is no point to set “nor before” to the “issued at” timestamp. This claim seems to be intended for use cases where a future date is given, so that a client can not use a token immediately (e.g. a subscription starts tomorrow and can not be used directly after token creation, see https://stackoverflow.com/questions/43291659/usage-of-nbf-in-json-web-tokens).

According to https://tools.ietf.org/html/rfc7519#section-4.1.5 the nbf claim is optional. Other implementations do not provide a “nbf” claim. Or they provide one which is set to value 0.

Proposal
Do not add a "nbf" claim by default.
To create tokens which are valid in the future, the nbf value should be controlled by client configuration or login application.

[aeneasr]

Thank you, I think we can have nbf optional as it really does not serve a lot of purpose.

[kanishkarj]

@aeneasr Has this been addressed yet?

[aeneasr]

No, the issue is still open. Contributions welcomed!

[anderslauri]

No, the issue is still open. Contributions welcomed!

@aeneasr,
I would be keen on taking on this task, we're expericing issues due to clock skew issues and making nbf optional would save us some headache. I see @Benehiko is assigned this task, however, would it be in order if I were to provide a PR within the next few days?

Thank you.

[aeneasr]

Yes, sounds good! I will unassign @Benehiko

[dominik-lekse]

@anderslauri Thanks for taking this. We have a related issue which is fixed by your PR.