typescript 46 lines · 8 steps

Decoding a JWT to check expiry

Parse a JWT's payload without a library and decide whether it has expired, allowing for clock skew.

Explained by highlit

Intermediate jwt base64url type-guards error-handling authentication

1interface JwtPayload {
exp?: number;
iat?: number;
sub?: string;
[key: string]: unknown;
6}
7 
8function decodeBase64Url(segment: string): string {
const padded = segment.replace(/-/g, "+").replace(/_/g, "/");
const withPadding = padded.padEnd(padded.length + ((4 - (padded.length % 4)) % 4), "=");
if (typeof atob === "function") {
  return decodeURIComponent(
    atob(withPadding)
      .split("")
      .map((c) => "%" + c.charCodeAt(0).toString(16).padStart(2, "0"))
      .join(""),
  );
}
return Buffer.from(withPadding, "base64").toString("utf-8");
20}
21 
22function parseJwtPayload(token: string): JwtPayload {
const parts = token.split(".");
if (parts.length !== 3) {
  throw new Error("Malformed JWT: expected 3 segments");
}
let payload: unknown;
try {
  payload = JSON.parse(decodeBase64Url(parts[1]));
} catch {
  throw new Error("Malformed JWT: payload is not valid JSON");
}
if (typeof payload !== "object" || payload === null) {
  throw new Error("Malformed JWT: payload is not an object");
}
return payload as JwtPayload;
37}
38 
39export function isTokenExpired(token: string, clockSkewSeconds = 30): boolean {
const { exp } = parseJwtPayload(token);
if (typeof exp !== "number" || !Number.isFinite(exp)) {
  throw new Error("JWT is missing a valid 'exp' claim");
}
const nowSeconds = Math.floor(Date.now() / 1000);
return nowSeconds >= exp - clockSkewSeconds;
46}

01 / 01

STEP 01

Walkthrough

Space play ←→ step click any line

Three takeaways

1JWTs are just base64url-encoded JSON, so you can inspect claims without a crypto library.
2Validate structure at each stage and narrow unknown types before trusting decoded data.
3A clock-skew allowance prevents flapping expiry decisions between machines with slightly different clocks.

Related explainers

typescript

import { registerLocaleData } from '@angular/common';
import localeFr from '@angular/common/locales/fr';
import localeFrExtra from '@angular/common/locales/extra/fr';
import localeDe from '@angular/common/locales/de';

Locale-aware bootstrapping in Angular

i18n localization dependency-injection

Intermediate 8 steps

rust

use serde::Deserialize;
 
#[derive(Debug, Deserialize)]
#[serde(untagged)]

Parsing flexible JSON shapes with serde

deserialization enums json

Intermediate 6 steps

ruby

require "shellwords"
require "open3"
 
module Backup

Building safe shell commands in Ruby

shell-out subprocess command-injection

Intermediate 7 steps

typescript

import { Module } from '@nestjs/common';
import { ConfigModule } from '@nestjs/config';
import * as Joi from 'joi';

Validating env config at boot in NestJS

configuration schema-validation environment-variables

Intermediate 8 steps

python

import time
import uuid
 
from django.utils.deprecation import MiddlewareMixin

Attaching per-request context in Django

middleware request lifecycle multi-tenancy

Intermediate 7 steps

typescript

import { Inject, Injectable, Logger } from '@nestjs/common';
import { CACHE_MANAGER } from '@nestjs/cache-manager';
import { Cache } from 'cache-manager';
import { InjectRepository } from '@nestjs/typeorm';