What does NBF stand for in JWT context?

5
votes

According to the docs of Identity Server, there's always the following four claims provided in each token:

  • Issuer name - iss
  • Client ID - client_id
  • Lifetime - exp
  • Scope - nbf

Given the lifetime is computed as expiration occasion, I understand all of the codes except for the last one. What does the code "NBF" stand for?

I even checked the disambiguation on Wikipedia but there's nothing relating tokens at all.

Bonus question. What's the reason behind the codes being of different format? I can't help wondering why client_id isn't following the same pattern and set to cid. I sense some historical context...

1
jwt

1 Answers

6
votes

Not before

That's what nbf means.

The usage of this claim is optional and it identifies the time before which the token must not be accepted.

See the definition from the RFC 7519:

4.1.5. "nbf" (Not Before) Claim

The nbf (not before) claim identifies the time before which the JWT MUST NOT be accepted for processing. The processing of the nbf claim requires that the current date/time MUST be after or equal to the not-before date/time listed in the nbf claim. Implementers MAY provide for some small leeway, usually no more than a few minutes, to account for clock skew. Its value MUST be a number containing a NumericDate value. Use of this claim is OPTIONAL.

The lifespan of the token starts after the time stated in the nbf claim and ends at the time stated in the exp claim.

Addressing your bonus question:

It's important to highlight that nbf is a standard claim registered in IANA while client_id is not. But it doesn't prevent client_id to be used.

Claim names can be defined at will by those using JWTs. The claims defined in the RFC 7519, however, are intentionally short:

All the names are short because a core goal of JWTs is for the representation to be compact.

This document also states the following:

Because a core goal of this specification is for the resulting representations to be compact, it is RECOMMENDED that the name be short -- that is, not to exceed 8 characters without a compelling reason to do so.