Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Reduce sensitivity of JWT iat check #343

Closed
aaronadamsCA opened this issue Jan 21, 2022 · 0 comments
Closed

Reduce sensitivity of JWT iat check #343

aaronadamsCA opened this issue Jan 21, 2022 · 0 comments

Comments

@aaronadamsCA
Copy link

Full steps to reproduce the issue:

  1. Set your system clock back by 1 second
  2. Try to use any --action that calls verify_oauth2_token

Expected outcome (what are you trying to do?): Still works.

Actual outcome (what errors or bad behavior do you see instead?): ValueError: Token used too early, 1642758070 < 1642758071. Check that your computer's clock is set correctly.

If you could add clock_skew_in_seconds=10 to your calls you should be able to cut issue volume without sacrificing security. This option was added in 2.4.0 of the auth library: googleapis/google-auth-library-python#894 - earlier versions had a baked-in value of 10 seconds, then there were a bunch of changes to the library that broke compatibility and for some reason they left the default in newer versions at 0, which breaks often in the real world.

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant