[peralva]

Description

verify() compared nbf against clockTimestamp, which is the current time truncated to whole seconds. When nbf is fractional, a token that is already active can be rejected with jwt not active. For example, with nbf = 1646822341.111 and Date.now() = 1646822341999, the truncated time is 1646822341, so nbf > clockTimestamp.

This change compares nbf against the exact current time (Date.now() / 1000). exp and maxAge keep using the truncated time, so their behavior does not change. When options.clockTimestamp is provided, it is still used as is.

References

Fixes #817

Testing

• Added a test where a fractional nbf that is already active within the current second is accepted.
• Added a test where a fractional nbf that is still in the future within the same second is rejected.
• npm test passes.