Require exp when verifying webhook JWTs

[SashaMIT]

Problem

WebhookReceiver.receive verifies the webhook JWT with JWT.require(alg).withIssuer(apiKey) only. java-jwt 4.x treats a missing exp as valid (claimVal == null passes the expiry check) unless withClaimPresence("exp") is set, so a hand-rolled token with a valid HMAC and no expiry verifies forever.

First-party AccessToken.toJwt always sets exp. This is the same gap livekit/protocol#1706 closed on the Go verifier, livekit/python-sdks#779 on Python, livekit/node-sdks#710 on Node, and livekit/server-sdk-ruby#97 on Ruby. This repo has no TokenVerifier; WebhookReceiver is the verify path.

Fix

Require the exp claim on verify.

Threat-model: the attacker can mint or obtain an HS256 token that omits exp. They do not control the verifier secret or clock. Signature verification still succeeds and the credential never ages out. That is permanent access from a forgotten expiry, not host or agent authority.

Test plan

• ./gradlew test --tests io.livekit.server.AccessTokenTest --tests io.livekit.server.WebhookReceiverTest (5/5)
• New case: signed token with no exp raises MissingClaimException
• Revert-test: drop withClaimPresence("exp") and that case fails (token is accepted)
• CI also runs WebhookReceiverTest so the new case is not AccessToken-only

Made with Cursor

[changeset-bot]

🦋 Changeset detected

Latest commit: 1b17fad

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
server-sdk-kotlin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[erikhortsch]

Thank you!

[SashaMIT]

Thanks for the review. Pushed the RegisteredClaims.EXPIRES_AT swap.