Disallowing Validation of Expired Tokens

[andreseloysv]

The Problem

The library first validates the signature of tokens before assessing their expiration status. This approach results in unnecessary CPU usage, as it not only validates signatures of expired tokens but also decodes them again using the verify method of node-jws. This double processing of expired but correctly signed tokens is inefficient and could be optimized.

The ideal solution

I would like the jsonwebtoken library to first verify if a token has expired before it checks the signature. This approach would improve efficiency and security by immediately discarding tokens that are no longer valid due to expiration.

Alternative

currently, one might manually check the expiration of the token before passing it to the library, but this adds extra steps and complexity to the authentication process.