Disabling Clock Skew in ASP.NET Core 3.1 JWT Authentication: Unresolved Behavior

ASP.NET Core 3.1’s JWT bearer middleware imposes a hard‑coded five‑minute clock skew that cannot be overridden via configuration or code. This default leeway allows tokens that have technically expired to remain valid for up to five minutes, potentially exposing applications to stale credential usage.

The primary objective is to enforce strict token expiration in environments running ASP.NET Core 3.1, where no documented API exists to disable the skew. Custom validation logic can be added, but its interaction with other middleware components and its impact on overall authentication flow remain unclear.

Key questions:

• Will future ASP.NET Core releases (e.g., 3.1.x or 5.x) expose a ClockSkew property that can be set to TimeSpan.Zero?
• If not, what is the most reliable approach to enforce zero clock skew without compromising the stability of the JWT middleware?
• Are there documented compatibility concerns when injecting custom validation logic into the existing authentication pipeline?