==========================================================================
 jwt-auth-demo - token expiry and the 60-second clock skew
 profiles: hs256,shortlived   (access-token-ttl = 2s)
==========================================================================

--------------------------------------------------------------------------
# T+0s  - fresh token

HTTP 200
{
    "name": "alice",
    "authorities": [
        "FACTOR_BEARER",
        "ROLE_USER",
        "SCOPE_profile:read"


--------------------------------------------------------------------------
# T+5s  - exp has passed, but JwtTimestampValidator allows 60s of clock skew
#         by default, so the token is STILL accepted. This surprises people
#         who write a test that sleeps past exp and expects a 401.

HTTP 200
{
    "name": "alice",
    "authorities": [
        "FACTOR_BEARER",
        "ROLE_USER",
        "SCOPE_profile:read"


--------------------------------------------------------------------------
# T+65s - past exp + the 60s skew window. Now it is refused.

HTTP 401
WWW-Authenticate: Bearer realm="jwt-auth-demo", error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: Jwt expired at 2026-08-22T06:16:50Z", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1", resource_metadata="http://localhost:8080/.well-known/oauth-protected-resource"


--------------------------------------------------------------------------
# end