jwt - Usage of nbf in json web tokens

Question

nbf: Defines the time before which the JWT MUST NOT be accepted for processing

I found this definition about nbf in json web tokens. But still wondering what the usage of nbf is? Why we use this? Does it relate to the term of security?

Any idea would be appreciated.

question from:https://stackoverflow.com/questions/43291659/usage-of-nbf-in-json-web-tokens

Answer 1

It definitely is up to how you interpret the time.

One of possible scenarios I could make up is literally - when a token must last from some particular point in time til another point in time.

Say, you're selling some API or resource. And a client purchased access that lasts for one hour and the access starts tomorrow in the midday.

So you issue a JWT with:

• iat set to now
• nbf set to tomorrow 12:00pm
• exp set to tomorrow 1:00pm