Require exp when verifying access tokens

ruby-jwt only checks expiry when the claim is present. A signed token with no exp therefore never expired. Match protocol#1706, python-sdks#779, and node-sdks#710.

Author: SashaMIT

lib/livekit/token_verifier.rb

@@ -10,7 +10,15 @@ def initialize(api_key: nil, api_secret: nil)
     end
 
     def verify(token)
-      decoded_token = JWT.decode(token, @api_secret, true, algorithm: AccessToken::SIGNING_ALGORITHM)
+      decoded_token = JWT.decode(
+        token,
+        @api_secret,
+        true,
+        {
+          algorithm: AccessToken::SIGNING_ALGORITHM,
+          required_claims: ["exp"],
+        },
+      )
       decoded = decoded_token.first
       if decoded["iss"] != @api_key
         raise "Invalid issuer"

spec/livekit/token_verifier_spec.rb

@@ -17,6 +17,18 @@
     expect(grant.attributes["mykey"]).to eq("myvalue")
   end
 
+  it "fails when exp is missing" do
+    payload = {
+      "iss" => TEST_KEY,
+      "sub" => "user",
+      "nbf" => Time.now.to_i - 5,
+      "video" => { "roomJoin" => true, "room" => "testroom" },
+    }
+    jwt = JWT.encode(payload, TEST_SECRET, "HS256")
+    v = described_class.new(api_key: TEST_KEY, api_secret: TEST_SECRET)
+    expect { v.verify(jwt) }.to raise_error(JWT::MissingRequiredClaim)
+  end
+
   it "fails on expired tokens" do
     token = LiveKit::AccessToken.new(api_key: TEST_KEY, api_secret: TEST_SECRET,
                                      identity: "test_identity", ttl: -10)