diff --git a/ctp_blogr.sqlite b/ctp_blogr.sqlite
index 2c95bfa..2f8e187 100644
Binary files a/ctp_blogr.sqlite and b/ctp_blogr.sqlite differ
diff --git a/ctp_blogr/__init__.py b/ctp_blogr/__init__.py
index b63beb8..e9c9598 100644
--- a/ctp_blogr/__init__.py
+++ b/ctp_blogr/__init__.py
@@ -28,7 +28,6 @@ def read_google_settings(settings):
     # Returnne un dict {google.client_id, google.client_secret}.
     # Le reglage de l'ini, s'il existe, l'emporte sur l'environnement.
     google = {}
-    # import pdb;pdb.set_trace()
     key = 'google.client_id'
     google[key] = settings.get(key)
     key = 'google.client_secret'
diff --git a/ctp_blogr/services/google_oauth.py b/ctp_blogr/services/google_oauth.py
index 7b88843..003f1f6 100644
--- a/ctp_blogr/services/google_oauth.py
+++ b/ctp_blogr/services/google_oauth.py
@@ -133,13 +133,18 @@ class GoogleOAuth(object):
 
     def verify_id_token(self, id_token, nonce):
         metadata = self.metadata()
+        # jwt.decode ne valide aucun claim : `registry` y est un JWSRegistry.
+        # La validation des claims se fait donc explicitement, apres decode.
         registry = joserfc_jwt.JWTClaimsRegistry(
+            leeway=60,
             iss={'essential': True, 'value': metadata.get('issuer')},
             aud={'essential': True, 'value': self.client_id},
+            exp={'essential': True},
         )
         try:
             token = joserfc_jwt.decode(
-                id_token, self.key_set(), algorithms=['RS256'], registry=registry)
+                id_token, self.key_set(), algorithms=['RS256'])
+            registry.validate(token.claims)
         except Exception as exc:
             raise GoogleOAuthError("Le id_token renvoye par Google est invalide : %s" % exc)
 
diff --git a/ctp_blogr/views/default.py b/ctp_blogr/views/default.py
index e312029..e6c5b0a 100644
--- a/ctp_blogr/views/default.py
+++ b/ctp_blogr/views/default.py
@@ -48,7 +48,6 @@ def login(request):
         session['oauth_nonce'] = nonce
         session['oauth_code_verifier'] = code_verifier
 
-        import pdb;pdb.set_trace()
         url = request.registry.google_oauth.create_authorization_url(
             redirect_uri=request.route_url('login_google_callback'),
             state=state,