Skip to content

OLIVE-598 Clarify JWT validation behavior when JWT security is disabled and per-request scope of expiry checks #818

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kamil-al wants to merge 2 commits into
base: main
Choose a base branch
from
Open

OLIVE-598 Clarify JWT validation behavior when JWT security is disabled and per-request scope of expiry checks #818

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a663fb1
OLIVE-598 Clarify JWT validation behavior when JWT security is disabl…
kamil-al Aug 17, 2026
0c7eff4
Address code review comments
kamil-al Aug 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions theolive/distribution/security/token-based-security.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ The token can be provided in one of two ways:

The token payload must include:

- **`exp`** — expiration time in epoch format. The token is rejected after this time.
- **`exp`** — expiration time in epoch format. Requests carrying the token are rejected after this time. Note that playback already in progress may continue past the token's expiry.
- **`nbf`** _(optional)_ — "not before" time in epoch format. The token is rejected before this time.

Additionally, the following standard optional claims are supported:
Expand All @@ -41,8 +41,9 @@ Additionally, the following standard optional claims are supported:

Requests without a valid token are rejected with an HTTP `403` response.

::::caution Tokens are validated even when token security is disabled
Disabling token security makes the token optional, but it does not make the CDN ignore it. Any JWT still included in a request — via the `Authorization` header or the `token` query parameter — is validated for well-formedness and expiry. In particular, an **expired** token is rejected with an HTTP `403`, even though the same request without a token would have been allowed. After disabling token security, make sure your players stop attaching (potentially stale) tokens.
::::caution A token you send is still checked even when token security is disabled
Disabling token security makes the token optional — it does not make the CDN ignore a token you do send. Any request that carries a JWT, via the `Authorization` header or the `token` query parameter, is checked: if the token is malformed or **expired**, that request is rejected with an HTTP `403`, even though the same request without a token would have been allowed. After disabling token security, make sure your players stop attaching (potentially stale) tokens.

::::

## Custom claims
Expand Down
6 changes: 3 additions & 3 deletions theolive/troubleshooting.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,6 @@ Some known issues and advisable configuration items:

## Playback

| Topic | Description |
| ------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Why do I get HTTP `403` responses while token-based security is disabled? | Even when [token-based security](./distribution/security/token-based-security.mdx) is disabled, any JWT included in a request (via the `Authorization` header or the `token` query parameter) is still validated for well-formedness and expiry. An **expired** or malformed token results in an HTTP `403`, even though the same request without a token would succeed. Make sure your player stops attaching stale tokens. |
| Topic | Description |
| ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Why do I get HTTP `403` responses while token-based security is disabled? | Even when [token-based security](./distribution/security/token-based-security.mdx) is disabled, any JWT included in a request (via the `Authorization` header or the `token` query parameter) is still checked for well-formedness and expiry. An **expired** or malformed token results in an HTTP `403` for that request, even though the same request without a token would succeed. Make sure your player stops attaching stale tokens. |