oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/JwtTimestampValidator.java
@Override
	public OAuth2TokenValidatorResult validate(Jwt jwt) {
		Assert.notNull(jwt, "jwt cannot be null");

		Instant expiry = jwt.getExpiresAt();

		if (expiry != null) {
			if (Instant.now(this.clock).minus(clockSkew).isAfter(expiry)) {
				OAuth2Error error = new OAuth2Error(
						OAuth2ErrorCodes.INVALID_REQUEST,
						String.format("Jwt expired at %s", jwt.getExpiresAt()),
						"https://tools.ietf.org/html/rfc6750#section-3.1");
				return OAuth2TokenValidatorResult.failure(error);
			}
		}

		Instant notBefore = jwt.getNotBefore();

		if (notBefore != null) {
			if (Instant.now(this.clock).plus(clockSkew).isBefore(notBefore)) {
				OAuth2Error error = new OAuth2Error(
						OAuth2ErrorCodes.INVALID_REQUEST,
						String.format("Jwt used before %s", jwt.getNotBefore()),
						"https://tools.ietf.org/html/rfc6750#section-3.1");
				return OAuth2TokenValidatorResult.failure(error);
			}
		}

		return OAuth2TokenValidatorResult.success();
	}
@Override
	public OAuth2TokenValidatorResult validate(Jwt jwt) {
		Assert.notNull(jwt, "jwt cannot be null");

		Instant expiry = jwt.getExpiresAt();

		if (expiry != null) {
			if (Instant.now(this.clock).minus(clockSkew).isAfter(expiry)) {
				OAuth2Error error = new OAuth2Error(
						OAuth2ErrorCodes.INVALID_REQUEST,
						String.format("Jwt expired at %s", jwt.getExpiresAt()),
						"https://tools.ietf.org/html/rfc6750#section-3.1");
				return OAuth2TokenValidatorResult.failure(error);
			}
		}

		Instant notBefore = jwt.getNotBefore();

		if (notBefore != null) {
			if (Instant.now(this.clock).plus(clockSkew).isBefore(notBefore)) {
				OAuth2Error error = new OAuth2Error(
						OAuth2ErrorCodes.INVALID_REQUEST,
						String.format("Jwt used before %s", jwt.getNotBefore()),
						"https://tools.ietf.org/html/rfc6750#section-3.1");
				return OAuth2TokenValidatorResult.failure(error);
			}
		}

		return OAuth2TokenValidatorResult.success();
	}
{@inheritDoc}