---
title: "Discussion on \"Why ASP.NET Core Accepts Expired JWTs (And How to Fix It)\" | Hashnode"
description: "Discussion on \"Why ASP.NET Core Accepts Expired JWTs (And How to Fix It)\". ASP.NET Core validates expired JWTs due to a default 5-minute clock skew. Learn why this happens, how frameworks compare, and how to set ClockSkew to zero."
url: "https://hashnode.com/posts/why-aspnet-core-accepts-expired-jwts/6af58b784b90906ebc6a38e2"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Why ASP.NET Core Accepts Expired JWTs (And How to Fix It)](https://doogal.dev/why-aspnet-core-accepts-expired-jwts?utm_source=hashnode&utm_medium=feed)

ASP.NET Core validates expired JWTs due to a default 5-minute clock skew. Learn why this happens, how frameworks compare, and how to set ClockSkew to zero.

1h ago · 4 min read · doogal.dev  
Read the article

-   [#dotnet](https://hashnode.com/tag/dotnet)
-   [#aspnetcore](https://hashnode.com/tag/aspnetcore)
-   [#jwt](https://hashnode.com/tag/jwt)
-   [#websecurity](https://hashnode.com/tag/websecurity)

## Written by

[Doogal Simpson](https://hashnode.com/@doogal)

@doogal

  
[View profile](https://hashnode.com/@doogal)

"hey doogal, what is .... ?"

## Responses

Markdown supported · ⌘↵ to post

No responses yet.