{"record":{"id":"3f94a5ceb680e436","repo":"lcobucci/jwt","slug":"value-is-not-in-the-allowed-date-format-value","errorCode":null,"errorMessage":"Value is not in the allowed date format: {value}","messagePattern":"Value is not in the allowed date format: (.+?)","errorType":"exception","errorClass":"Lcobucci\\JWT\\Token\\InvalidTokenStructure","httpStatus":null,"severity":"error","filePath":"src/Token/Parser.php","lineNumber":155,"sourceCode":"     * @param array<string, mixed> $array\n     * @param non-empty-string     $part\n     *\n     * @phpstan-assert array<non-empty-string, mixed> $array\n     */\n    private function guardAgainstEmptyStringKeys(array $array, string $part): void\n    {\n        foreach ($array as $key => $value) {\n            if ($key === '') {\n                throw InvalidTokenStructure::arrayExpected($part);\n            }\n        }\n    }\n\n    /** @throws InvalidTokenStructure */\n    private function convertDate(int|float|string $timestamp): DateTimeImmutable\n    {\n        if (! is_numeric($timestamp)) {\n            throw InvalidTokenStructure::dateIsNotParseable($timestamp);\n        }\n\n        $normalizedTimestamp = number_format((float) $timestamp, self::MICROSECOND_PRECISION, '.', '');\n\n        $date = DateTimeImmutable::createFromFormat('U.u', $normalizedTimestamp);\n\n        if ($date === false) {\n            throw InvalidTokenStructure::dateIsNotParseable($normalizedTimestamp);\n        }\n\n        return $date;\n    }\n\n    /**\n     * Returns the signature from given data\n     *\n     * @param non-empty-string $data\n     */","sourceCodeStart":137,"sourceCodeEnd":173,"githubUrl":"https://github.com/lcobucci/jwt/blob/375813049c24c7111bda8b6884c57b071ceb2fe7/src/Token/Parser.php#L137-L173","documentation":"Date-related registered claims (iat, nbf, exp) must be numeric timestamps. When the parsed value is neither an int, float, nor numeric string, convertDate rejects it because it cannot be converted to a DateTimeImmutable. The library strictly enforces the timestamp-based date format for these claims.","triggerScenarios":"Parsing a token whose iat/nbf/exp claim is a non-numeric value such as an ISO-8601 date string (\"2026-01-01T00:00:00Z\"), a bool, an array, or null instead of a Unix timestamp.","commonSituations":"Issuers that emit human-readable date strings instead of Unix timestamps (a common spec misunderstanding); tokens generated by libraries configured for ISO dates; manually edited token payloads.","solutions":["Fix the issuer to emit integer Unix timestamps for iat/nbf/exp","Convert the value to a Unix timestamp on the issuing side, e.g. $d->getTimestamp()","Parse the token leniently or pre-transform the claims if you control the parsing pipeline"],"exampleFix":"// before\n{\"iat\": \"2026-01-01T00:00:00Z\"}\n// after\n{\"iat\": 1767225600}","handlingStrategy":"validation","validationCode":"$claims = json_decode(base64_decode($payloadPart), true);\nforeach (['iat','nbf','exp'] as $c) {\n    if (isset($claims[$c]) && !is_numeric($claims[$c])) {\n        throw new \\InvalidArgumentException(\"$c must be a numeric Unix timestamp\");\n    }\n}","typeGuard":"function isNumericTimestamp(mixed $v): bool { return is_int($v) || is_float($v) || (is_string($v) && is_numeric($v)); }","tryCatchPattern":"try {\n    $token = $parser->parse($jwt);\n} catch (InvalidTokenStructure $e) {\n    // token has a non-numeric date claim; reject\n}","preventionTips":["Configure issuers to emit integer Unix timestamps for date claims","Add contract tests asserting iat/nbf/exp are ints","Document the expected claim types in your issuer library"],"tags":["jwt","date-claims","timestamp","parsing"],"backgroundTag":"invalid-date-format","analyzedSha":"375813049c24c7111bda8b6884c57b071ceb2fe7","analyzedAt":"2026-09-14T11:12:28.004Z","contentChangedAt":"2026-09-14T11:12:28.004Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}