diff --git a/server/SecureToken.ts b/server/SecureToken.ts
index 870081d..ccd1bc1 100644
--- a/server/SecureToken.ts
+++ b/server/SecureToken.ts
@@ -153,6 +153,12 @@ export async function generateSecurePlaintextToken<T extends object>(validUntil:
 }
 
 export async function parseSecurePlaintextToken<T extends object>(secureToken: SecurePlaintextToken, presharedTokenSecret?: string): Promise<T> {
+    const now = new Date();
+    const validUntil = new Date(secureToken.validUntil);
+    if (now > validUntil) {
+        throw new Error("token expired");
+    }
+
     if (!presharedTokenSecret) {
         if (!staticPresharedTokenSecret) {
             throw new Error("PRESHARED_TOKEN_SECRET is not set");