{"record":{"id":"b95bd4dbd115cbd8","repo":"lcobucci/jwt","slug":"issued-at-claim-missing","errorCode":null,"errorMessage":"\"Issued At\" claim missing","messagePattern":"\"Issued At\" claim missing","errorType":"validation","errorClass":"ConstraintViolation","httpStatus":null,"severity":"error","filePath":"src/Validation/Constraint/StrictValidAt.php","lineNumber":77,"sourceCode":"    }\n\n    /** @throws ConstraintViolation */\n    private function assertMinimumTime(UnencryptedToken $token, DateTimeInterface $now): void\n    {\n        if (! $token->claims()->has(Token\\RegisteredClaims::NOT_BEFORE)) {\n            throw ConstraintViolation::error('\"Not Before\" claim missing', $this);\n        }\n\n        if (! $token->isMinimumTimeBefore($now)) {\n            throw ConstraintViolation::error('The token cannot be used yet', $this);\n        }\n    }\n\n    /** @throws ConstraintViolation */\n    private function assertIssueTime(UnencryptedToken $token, DateTimeInterface $now): void\n    {\n        if (! $token->claims()->has(Token\\RegisteredClaims::ISSUED_AT)) {\n            throw ConstraintViolation::error('\"Issued At\" claim missing', $this);\n        }\n\n        if (! $token->hasBeenIssuedBefore($now)) {\n            throw ConstraintViolation::error('The token was issued in the future', $this);\n        }\n    }\n}\n","sourceCodeStart":59,"sourceCodeEnd":85,"githubUrl":"https://github.com/lcobucci/jwt/blob/375813049c24c7111bda8b6884c57b071ceb2fe7/src/Validation/Constraint/StrictValidAt.php#L59-L85","documentation":"StrictValidAt mandates the 'iat' (Issued At) claim; assertIssueTime throws '\"Issued At\" claim missing' when the claim set has no iat. Strict mode deliberately rejects tokens without issuance timestamps to prevent accepting tokens of unknown provenance.","triggerScenarios":"Validator::assert($token, new StrictValidAt(...)) on a token created without ->issuedAt(...) — the RegisteredClaims::ISSUED_AT claim is absent.","commonSituations":"Old token builders that only set exp; tokens minted by external systems that omit iat; moving from LooseValidAt/lenient checks to StrictValidAt causing legacy tokens to fail; test fixtures handcrafted without iat.","solutions":["Fix the issuer to always call ->issuedAt(new DateTimeImmutable(...)) when building tokens","Use a less strict validator if your token profile does not guarantee iat","Pre-check $token->claims()->has('iat') and reject with an explicit 'token missing iat' error at the boundary","Reissue legacy tokens that predate the iat requirement"],"exampleFix":"// before\n$builder->expiresAt($now->modify('+1 hour'));\n// after\n$builder->issuedAt($now)->expiresAt($now->modify('+1 hour'));","handlingStrategy":"validation","validationCode":"if (! $token->claims()->has('iat')) {\n    throw new InvalidArgumentException('Token must carry iat claim for StrictValidAt');\n}","typeGuard":"function hasIssuedAtClaim(UnencryptedToken $t): bool { return $t->claims()->has('iat'); }","tryCatchPattern":"try {\n    $validator->assert($token, new StrictValidAt($clock));\n} catch (ConstraintViolation $e) {\n    if (str_contains($e->getMessage(), '\"Issued At\" claim missing')) { /* reject; fix issuer */ }\n}","preventionTips":["Always set iat in your token builder wrapper","Validate third-party tokens for required claims before running strict validators","Include iat/nbf/exp requirements in API contracts with token issuers"],"tags":["jwt","missing-claim","issued-at","validation"],"backgroundTag":"missing-required-claim","analyzedSha":"375813049c24c7111bda8b6884c57b071ceb2fe7","analyzedAt":"2026-09-14T11:12:28.004Z","contentChangedAt":"2026-09-14T11:12:28.004Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}