The headline is about JWT expiry checks being off by 1000x due to NumericDate (seconds) vs JavaScript's Date.now() (milliseconds) mismatch.

Short summary

JWT expiry claims (exp, iat, nbf) use NumericDate — seconds since epoch — while JavaScript's Date.now() returns milliseconds, causing a 1000x mismatch that logs users out instantly or never expires tokens. Fix it by multiplying exp by 1000 or dividing Date.now() by 1000, and add a small clock-skew buffer. Client-side decoding only reads the token; signature verification must always happen server-side for any authorization decision.

• •JWT exp/iat/nbf are in seconds; Date.now() is in milliseconds — never mix them
• •Multiply exp by 1000 or divide Date.now() by 1000 before comparing
• •Client-side decode is for UI hints only; signature verification belongs on the server

Generated with AI, which can make mistakes.