{"record":{"id":"9a75fb7fcac96048","repo":"lcobucci/jwt","slug":"not-before-claim-missing","errorCode":null,"errorMessage":"\"Not Before\" claim missing","messagePattern":"\"Not Before\" claim missing","errorType":"validation","errorClass":"ConstraintViolation","httpStatus":null,"severity":"error","filePath":"src/Validation/Constraint/StrictValidAt.php","lineNumber":65,"sourceCode":"    }\n\n    /** @throws ConstraintViolation */\n    private function assertExpiration(UnencryptedToken $token, DateTimeInterface $now): void\n    {\n        if (! $token->claims()->has(Token\\RegisteredClaims::EXPIRATION_TIME)) {\n            throw ConstraintViolation::error('\"Expiration Time\" claim missing', $this);\n        }\n\n        if ($token->isExpired($now)) {\n            throw ConstraintViolation::error('The token is expired', $this);\n        }\n    }\n\n    /** @throws ConstraintViolation */\n    private function assertMinimumTime(UnencryptedToken $token, DateTimeInterface $now): void\n    {\n        if (! $token->claims()->has(Token\\RegisteredClaims::NOT_BEFORE)) {\n            throw ConstraintViolation::error('\"Not Before\" claim missing', $this);\n        }\n\n        if (! $token->isMinimumTimeBefore($now)) {\n            throw ConstraintViolation::error('The token cannot be used yet', $this);\n        }\n    }\n\n    /** @throws ConstraintViolation */\n    private function assertIssueTime(UnencryptedToken $token, DateTimeInterface $now): void\n    {\n        if (! $token->claims()->has(Token\\RegisteredClaims::ISSUED_AT)) {\n            throw ConstraintViolation::error('\"Issued At\" claim missing', $this);\n        }\n\n        if (! $token->hasBeenIssuedBefore($now)) {\n            throw ConstraintViolation::error('The token was issued in the future', $this);\n        }\n    }","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/lcobucci/jwt/blob/375813049c24c7111bda8b6884c57b071ceb2fe7/src/Validation/Constraint/StrictValidAt.php#L47-L83","documentation":"StrictValidAt requires the 'nbf' (Not Before) registered claim to be present and asserts it, because strict mode treats all three time claims (iat, nbf, exp) as mandatory. If the claim set lacks nbf, assertMinimumTime throws '\"Not Before\" claim missing' without evaluating token usability.","triggerScenarios":"Validator::assert($token, new StrictValidAt(...)) on a token built without ->canOnlyBeUsedAfter() (or otherwise without the nbf claim).","commonSituations":"Minimal token issuers that only set iat/exp; third-party-issued JWTs that omit nbf; migrating from a lenient validator to StrictValidAt and older tokens lacking nbf suddenly rejected.","solutions":["Fix the issuer to include ->canOnlyBeUsedAfter($now) (nbf) when building tokens","Use a validator variant that does not require all claims if strictness is not required for your profile","Add a claims()->has('nbf') pre-check at the trust boundary and surface a clearer rejection reason","Coordinate the validator upgrade with reissuance of tokens that include nbf"],"exampleFix":"// before\n$builder->issuedAt($now)->expiresAt($now->modify('+1 hour'));\n// after\n$builder->issuedAt($now)->canOnlyBeUsedAfter($now)->expiresAt($now->modify('+1 hour'));","handlingStrategy":"validation","validationCode":"if (! $token->claims()->has('nbf')) {\n    throw new InvalidArgumentException('Token must carry nbf claim for StrictValidAt');\n}","typeGuard":"function hasNotBeforeClaim(UnencryptedToken $t): bool { return $t->claims()->has('nbf'); }","tryCatchPattern":"try {\n    $validator->assert($token, new StrictValidAt($clock));\n} catch (ConstraintViolation $e) {\n    if (str_contains($e->getMessage(), '\"Not Before\" claim missing')) { /* reject; fix issuer */ }\n}","preventionTips":["Standardize token creation on a helper that always sets iat/nbf/exp","When upgrading to strict validation, reissue or reject legacy tokens missing nbf"],"tags":["jwt","missing-claim","validation","strict-mode"],"backgroundTag":"missing-required-claim","analyzedSha":"375813049c24c7111bda8b6884c57b071ceb2fe7","analyzedAt":"2026-09-14T11:12:28.004Z","contentChangedAt":"2026-09-14T11:12:28.004Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}