Is it possible to verify if a JWE token has expired? or set an expiry time for a JWE token?

[dalegacusan]

Just like JWTs where they have an expiration time, is it possible with jose?

[panva]

JWEs just like JWSs do not have expiration. JWT in either JWS or JWE syntax do. And for JWT using JWE syntax there's a module. ¹². Be sure to choose the right algorithm for encrypted JWEs tho. They only really make sense if you're both the issuer and recipient, the alg: dir and enc: A256GCM is a good fit then. Otherwise Signed JWTs are really superior in being able to provide non-repudiation.

Footnotes

1. https://github.com/panva/jose/blob/v4.1.1/docs/classes/jwt_encrypt.EncryptJWT.md ↩

2. https://github.com/panva/jose/blob/v4.1.1/docs/functions/jwt_decrypt.jwtDecrypt.md ↩

[Spomky]

Although this is true, it is not an exact answer.

It is possible for an encrypted token (JWE) or a signed token (JWS) to have an expiration time.
The exp claim is designed for this purpose. The problem is that this claim is not readable with a JWE. This is why the RFC7519, section 5.3 aloows Replicating Claims as Header Parameters.

With replicated claims, it is possible for your application to know if the token has expired by reading the exp header before any cryptographic operations, and then rejecting any that violate your application's policy.

[panva]

But in order for a claim to be replicated the token first needs to be a JWT in a JWE syntax. That's fine and such token can obviously have an expiration, it's a JWT.

OTOH JWE or JWS with arbitrary payloads / plaintexts have nothing to replicate.

[Spomky]

OTOH JWE or JWS with arbitrary payloads / plaintexts have nothing to replicate.

I agree with that, but nothing prevent from using the exp header parameter with arbitrary payloads.
The use of header parameters should be adapted depending on the application context. If it is important to have an expiration, then it should be possible to set it like in this example from the RFC7515 (noting that it should be understood by the token consumer).