Add checking of nbf claim

Author: Brendan Abbott

Authentication/JWT.php

@@ -61,12 +61,22 @@ public static function decode($jwt, $key = null, $verify = true)
                     throw new DomainException('"kid" empty, unable to lookup correct key');
                 }
             }
+
+            // Check the signature
             if (!JWT::verify("$headb64.$bodyb64", $sig, $key, $header->alg)) {
                 throw new UnexpectedValueException('Signature verification failed');
             }
+
             // Check token expiry time if defined.
             if (isset($payload->exp) && time() >= $payload->exp) {
-                throw new UnexpectedValueException('Expired Token');
+                throw new UnexpectedValueException('Expired token');
+            }
+
+            // Check if the nbf if it is defined.
+            if (isset($payload->nbf) && $payload->nbf > time()) {
+                throw new UnexpectedValueException(
+                    'Cannot handle token prior to ' . date(DateTime::ISO8601, $payload->nbf)
+                );
             }
         }
         return $payload;

tests/JWTTest.php

@@ -45,6 +45,16 @@ public function testExpiredToken()
         JWT::decode($encoded);
     }
 
+    public function testTooEarlyToken()
+    {
+        $this->setExpectedException('UnexpectedValueException');
+        $payload = array(
+            "message" => "abc",
+            "nbf" => time() + 20); // time in the past
+        $encoded = JWT::encode($payload, 'my_key');
+        JWT::decode($encoded);
+    }
+
     public function testValidToken()
     {
         $payload = array(
@@ -55,6 +65,17 @@ public function testValidToken()
         $this->assertEquals($decoded->message, 'abc');
     }
 
+    public function testValidTokenWithNbf()
+    {
+        $payload = array(
+            "message" => "abc",
+            "exp" => time() + 20, // time in the future
+            "nbf" => time() - 20);
+        $encoded = JWT::encode($payload, 'my_key');
+        $decoded = JWT::decode($encoded, 'my_key');
+        $this->assertEquals($decoded->message, 'abc');
+    }
+
     public function testInvalidToken()
     {
         $payload = array(