exp claim doesnt support scientific notation

[ajayd942]

Checklist

• I have looked into the Readme and Examples, and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

If we have a jwt token, with exp claim value as

"exp": 1.733162101e+26,

the library fails to decode the token. We get a JWTDecodeException with error "The claim 'exp' contained a non-numeric date value."

According the RFC on JWT(https://datatracker.ietf.org/doc/html/rfc7519#section-2), a NumericDate should adhere to IEEE Std 1003, according to which scientific notation representation is valid.

Reproduction

1. Create a jwt token with exp claim in scientific notation.
2. Try to decode the token. It will fail with "The claim 'exp' contained a non-numeric date value."

Additional context

No response

java-jwt version

4.4.0

Java version

17

[tanya732]

Hi @ajayd942,

Thank you for raising,

I'll look ahead this issue and try to reproduce. I'll keep you posted for further updates.

Thank you

[tanya732]

Hi @ajayd942

Thanks for the report and for pointing to the RFC.

The issue isn't support for scientific notation itself, java-jwt already accepts valid NumericDate values. The reported value, 1.733162101e+26, is a valid JSON number but exceeds the range representable as a NumericDate, so deserialization fails.

What was actually wrong was the error message: out-of-range numeric values were being reported as "non-numeric", which is misleading.

PR #774 fixes that by distinguishing between:

• genuinely non-numeric values; and
• numeric values that are outside the representable NumericDate range.

This will be addressed in next release.

Thank you

[tanya732]

Hi @ajayd942

This is resolved in v4.6.0. Thanks for the detailed report and the RFC reference. Closing as resolved.

If you run into any problems or have further questions, feel free to comment here and I'll be happy to reopen the issue.

Thank you