why not check the exp time when parse token about casdoor-java-sdk

[casbin-bot]

@tangyang9464 @JalinWang @imp2002

[hsluoyz]

@ddavidzhang hasn't this code already checked exp time?

casdoor-java-sdk/src/main/java/org/casbin/casdoor/service/AuthService.java

Lines 71 to 106 in 26b92ec

	public User parseJwtToken(String token) {
	// parse jwt token
	SignedJWT parseJwt = null;
	try {
	parseJwt = SignedJWT.parse(token);
	} catch (ParseException e) {
	throw new AuthException("Cannot parse jwt token.", e);
	}
	// verify the jwt public key
	try {
	CertificateFactory cf = CertificateFactory.getInstance("X.509");
	X509Certificate cert = (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(config.certificate.getBytes()));
	RSAPublicKey publicKey = (RSAPublicKey) cert.getPublicKey();
	JWSVerifier verifier = new RSASSAVerifier(publicKey);
	boolean verify = parseJwt.verify(verifier);
	if (!verify) {
	throw new AuthException("Cannot verify signature.");
	}
	} catch (CertificateException | JOSEException e) {
	throw new AuthException("Cannot verify signature.", e);
	}
	// read "access_token" from payload and convert to CasdoorUser
	try {
	JWTClaimsSet claimsSet = parseJwt.getJWTClaimsSet();
	String userJson = claimsSet == null ? null : claimsSet.toString();
	if (userJson == null || userJson.isEmpty()) {
	throw new AuthException("Cannot get claims from JWT payload");
	}
	return objectMapper.readValue(userJson, User.class);
	} catch (JsonProcessingException | java.text.ParseException e) {
	throw new AuthException("Cannot convert claims to User", e);
	}
	}