Use iat_leeway option

[wohlgejm]

It looks like iat_leeway is not being used when verifying iat. I believe #272 fixes this. There's a spec that asserts global leeway is not used during this verification, so is iat_leeway not meant to be used?

[excpt]

Hi @wohlgejm,

I just read the RFC again.

Only the exp and nbf claims should implement a leeway. The iat claim provides only information about the creation of the token. The exp and nbf tokens should be used for time based validations against the token.

The iat_leeway should be removed then from the code as it not specified in the RFC.

Source: https://tools.ietf.org/html/rfc7519#section-4.1.6

[wohlgejm]

👍 thanks for the quick response @excpt. Would you take a PR to remove it?

[excpt]

Yes. This would be great.