"exp" > 24 hours does not result in an error.

[gauntface]

If I set an expiration to something greater than 24 hours (i.e. 48 hours) in the VAPID JWT, I'm not receiving an error which I think it's meant to:

An "exp" (Expiry) claim MUST be included with the time after which
the token expires. This limits the time that a token over which a
token is valid. An "exp" claim MUST NOT be more than 24 hours
from the time of the request.

[jrconlin]

We are a bit lax on this because we want to encourage folks to use VAPID. Right now, folks are struggling to just get the encryption right (we see a lot of that from the logs). Considering the fun of clock skew and time sync errors, we decided to remove one hurdle.

Yes, this does expose folks to potential replay errors against themselves, however the actual incidence of this is very low. We do expect to start enforcing the standard once it is finalized.

[gauntface]

Ta for the info :) 👍