func (s *FositeSQLStore) ClientAssertionJWTValid(ctx context.Context, jti string) error {
	d, err := s.getClientAssertionJWT(ctx, jti)
	if errors.Is(err, sqlcon.ErrNoRows) {
		// the jti is not known => valid
		return nil
	} else if err != nil {
		return err
	}
	if d.Expiry.After(time.Now()) {
		// the jti is not expired yet => invalid
		return errors.WithStack(fosite.ErrJTIKnown)
	}
	// the jti is expired => valid
	return nil
}
A capture-replay flaw exists when the design of the software makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).