Add :leeway option to jwt.

This allows specify some leeway for jwt claims
validation.

src/buddy/sign/jwt.clj

@@ -19,28 +19,37 @@
             [buddy.sign.util :as util]
             [cheshire.core :as json]))
 
-(defn- validate-claims [claims {:keys [max-age iss aud now] :or
-                               {now (util/now)}}]
-
+(defn- validate-claims
+  [claims {:keys [max-age iss aud now leeway] :or {now (util/now) leeway 0}}]
   (let [now (util/to-timestamp now)]
+
+    ;; Check the `:iss` claim.
     (when (and iss (let [iss-claim (:iss claims)]
                      (if (coll? iss)
                        (not-any? #{iss-claim} iss)
                        (not= iss-claim iss))))
       (throw (ex-info (str "Issuer does not match " iss)
                       {:type :validation :cause :iss})))
+
+    ;; Check the `:aud` claim.
     (when (and aud (let [aud-claim (:aud claims)]
                      (if (coll? aud-claim)
                        (not-any? #{aud} aud-claim)
                        (not= aud aud-claim))))
       (throw (ex-info (str "Audience does not match " aud)
                       {:type :validation :cause :aud})))
-    (when (and (:exp claims) (>= now (:exp claims)))
+
+    ;; Check the `:exp` claim.
+    (when (and (:exp claims) (<= (:exp claims) (- now leeway)))
       (throw (ex-info (format "Token is expired (%s)" (:exp claims))
                       {:type :validation :cause :exp})))
-    (when (and (:nbf claims) (< now (:nbf claims)))
+
+    ;; Check the `:nbf` claim.
+    (when (and (:nbf claims) (> (:nbf claims) (+ now leeway)))
       (throw (ex-info (format "Token is not yet valid (%s)" (:nbf claims))
                       {:type :validation :cause :nbf})))
+
+    ;; Check the `:max-age` option.
     (when (and (:iat claims) (number? max-age) (> (- now (:iat claims)) max-age))
       (throw (ex-info (format "Token is older than max-age (%s)" max-age)
                       {:type :validation :cause :max-age})))

src/buddy/sign/util.clj

@@ -51,7 +51,7 @@
                        (.invoke method this (make-array Object 0)))})))
 
 (defn now
-  "Get a current timestamp."
+  "Get a current timestamp in seconds."
   []
   (quot (System/currentTimeMillis) 1000))
 

test/buddy/sign/jwt_tests.clj

@@ -106,14 +106,18 @@
             signed    (make-jwt-fn candidate)]
         (unsign-exp-succ signed candidate {:now 0})
         (unsign-exp-succ signed candidate {:now 9})
+        (unsign-exp-succ signed candidate {:now 10 :leeway 1})
         (unsign-exp-fail signed :exp {:now 10})
-        (unsign-exp-fail signed :exp {:now 11})))
+        (unsign-exp-fail signed :exp {:now 11})
+        (unsign-exp-fail signed :exp {:now 12 :leeway 1})))
 
     (testing ":nbf claim validation"
       (let [candidate {:foo "bar" :nbf 10}
             signed    (make-jwt-fn candidate)]
         (unsign-exp-fail signed :nbf {:now 0})
+        (unsign-exp-fail signed :nbf {:now 8 :leeway 1})
         (unsign-exp-fail signed :nbf {:now 9})
+        (unsign-exp-succ signed candidate {:now 9 :leeway 1})
         (unsign-exp-succ signed candidate {:now 10})
         (unsign-exp-succ signed candidate {:now 11})))