Skip to content

Commit

Permalink
Don't test that JWT's issued in future are invalid
Browse files Browse the repository at this point in the history
Remove two tests that JWT's whose `iat` value claims that they were
issued in the future fail validation.

These two tests fail on newer versions of PyJWT:

#4672

This is because PyJWT no longer raises an exception for future `iat`
times:

jpadilla/pyjwt#190

PyJWT removed this validation because:

- Clock skew can cause one party to generate `iat` times a few seconds
or minutes ahead of another's current time

- The JWT spec (RFC 7519) doesn't say that a JWT with a future `iat`
should be considered invalid, these JWTs are valid

- Other JWT libraries don't do this check
  • Loading branch information
seanh committed Nov 7, 2017
1 parent 34438d3 commit ddec2c4
Show file tree
Hide file tree
Showing 2 changed files with 0 additions and 14 deletions.
5 changes: 0 additions & 5 deletions tests/h/auth/tokens_test.py
Original file line number Diff line number Diff line change
Expand Up @@ -48,11 +48,6 @@ def test_token_with_past_expiry_is_not_valid(self):
lambda k: jwt.encode({'exp': _seconds_from_now(-3600)},
key=k),

# Issued in the future
lambda k: jwt.encode({'exp': _seconds_from_now(3600),
'iat': _seconds_from_now(1800)},
key=k),

# Incorrect encoding key
lambda k: jwt.encode({'exp': _seconds_from_now(3600)},
key='somethingelse'),
Expand Down
9 changes: 0 additions & 9 deletions tests/h/oauth/jwt_grant_token_test.py
Original file line number Diff line number Diff line change
Expand Up @@ -173,15 +173,6 @@ def test_init_raises_for_nbf_claim_in_future(self, claims):

assert exc.value.description == 'Grant token is not yet valid.'

def test_init_raises_for_iat_claim_in_future(self, claims):
claims['iat'] = epoch(delta=timedelta(minutes=13))
jwttok = jwt_token(claims)

with pytest.raises(InvalidGrantError) as exc:
VerifiedJWTGrantToken(jwttok, 'top-secret', 'test-audience')

assert exc.value.description == 'Grant token issue time (iat) is in the future.'

def test_expiry_returns_exp_claim(self, claims):
now = datetime.utcnow().replace(microsecond=0)
delta = timedelta(minutes=2)
Expand Down

0 comments on commit ddec2c4

Please sign in to comment.