{"record":{"id":"95810c95c97b2549","repo":"lcobucci/jwt","slug":"the-token-cannot-be-used-yet-strictvalidat","errorCode":null,"errorMessage":"The token cannot be used yet","messagePattern":"The token cannot be used yet","errorType":"validation","errorClass":"ConstraintViolation","httpStatus":null,"severity":"error","filePath":"src/Validation/Constraint/StrictValidAt.php","lineNumber":69,"sourceCode":"    {\n        if (! $token->claims()->has(Token\\RegisteredClaims::EXPIRATION_TIME)) {\n            throw ConstraintViolation::error('\"Expiration Time\" claim missing', $this);\n        }\n\n        if ($token->isExpired($now)) {\n            throw ConstraintViolation::error('The token is expired', $this);\n        }\n    }\n\n    /** @throws ConstraintViolation */\n    private function assertMinimumTime(UnencryptedToken $token, DateTimeInterface $now): void\n    {\n        if (! $token->claims()->has(Token\\RegisteredClaims::NOT_BEFORE)) {\n            throw ConstraintViolation::error('\"Not Before\" claim missing', $this);\n        }\n\n        if (! $token->isMinimumTimeBefore($now)) {\n            throw ConstraintViolation::error('The token cannot be used yet', $this);\n        }\n    }\n\n    /** @throws ConstraintViolation */\n    private function assertIssueTime(UnencryptedToken $token, DateTimeInterface $now): void\n    {\n        if (! $token->claims()->has(Token\\RegisteredClaims::ISSUED_AT)) {\n            throw ConstraintViolation::error('\"Issued At\" claim missing', $this);\n        }\n\n        if (! $token->hasBeenIssuedBefore($now)) {\n            throw ConstraintViolation::error('The token was issued in the future', $this);\n        }\n    }\n}\n","sourceCodeStart":51,"sourceCodeEnd":85,"githubUrl":"https://github.com/lcobucci/jwt/blob/375813049c24c7111bda8b6884c57b071ceb2fe7/src/Validation/Constraint/StrictValidAt.php#L51-L85","documentation":"When the 'nbf' claim is present, StrictValidAt checks $token->isMinimumTimeBefore($now->add(leeway)); if the current time is still before nbf, the token is not yet usable and it throws 'The token cannot be used yet'. This rejects tokens used ahead of their Not Before window.","triggerScenarios":"Validating a token whose nbf timestamp is in the future relative to now + leeway — e.g. token issued for delayed activation, or verifier clock behind issuer clock by more than the leeway.","commonSituations":"Server clock skew: verifier's clock lags the issuer, so a just-issued token looks 'not yet valid'; issuer set nbf with an intentional future start time; containers/VMs with drifted clocks and no NTP; leeway configured too small.","solutions":["Check/wait until nbf before using the token (client-side retry after the timestamp)","Synchronize clocks with NTP on the verifying server","Increase the leeway interval passed to StrictValidAt to absorb moderate skew","Have the issuer stop setting a future nbf if tokens are meant to be immediately usable"],"exampleFix":"// before\nnew StrictValidAt($clock, new DateInterval('PT0S'));\n// after (allow 30s skew)\nnew StrictValidAt($clock, new DateInterval('PT30S'));","handlingStrategy":"retry","validationCode":"$nbf = $token->claims()->get('nbf');\nif ($nbf instanceof DateTimeInterface && $nbf > (new DateTimeImmutable())->add($leeway)) {\n    // schedule retry at $nbf instead of failing\n}","typeGuard":"null","tryCatchPattern":"try {\n    $validator->assert($token, new StrictValidAt($clock, $leeway));\n} catch (ConstraintViolation $e) {\n    if ($e->getMessage() === 'The token cannot be used yet') { /* delay and retry, or reject */ }\n}","preventionTips":["Keep all servers NTP-synchronized","Issue tokens with nbf = now (not future) unless delayed activation is intended","Configure leeway proportional to your worst-case measured clock skew"],"tags":["jwt","not-before","clock-skew","validation"],"backgroundTag":"jwt-token-not-yet-valid","analyzedSha":"375813049c24c7111bda8b6884c57b071ceb2fe7","analyzedAt":"2026-09-14T11:12:28.004Z","contentChangedAt":"2026-09-14T11:12:28.004Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}