Is there a way to configure an acceptable clock skew?

[mwillfox]

Hello, I am trying to use this project to validate OIDC tokens from GitHub and I notice that GitHub tokens consistently have an iat claim of 1+ second after I receive a request from my GitHub Action. Clearly there is a clock sync issue between GitHub and my API (although I've done all I can by running NTP and ensuring I'm in sync on my machine).

Is there a way to configure an acceptable clock skew for validation of these time-based claims?

[lestrrat]

Sorry, I don't get notifications for discussions, and this went unnoticed.
Have you tried jwt.WithAcceptableSkew()?

[cscochris]

does WithAcceptableSkew work with iat ? the code comment indicates it only applies to nbf and exp - which is reasonable. Further - does it make sense to consider iat as part of the default/mandatory claims, especially in the presence of nbf?

We have a situation here where we occasionally see JWTs where nbf validates but iat does not - nbf is intentionally set one minute in the past by the JWT issuer apparently for this reason.

We could use WithResetValidators() to remove the iat check, but could there be a better way? It seems to me that the library should ignore the iat check if the nbf check has already passed?

Further reference: https://auth0.com/docs/secure/tokens/json-web-tokens/json-web-token-claims#registered-claims

iat (issued at time): Time at which the JWT was issued; can be used to determine age of the JWT
nbf (not before time): Time before which the JWT must not be accepted for processing

is iat supposed to be a hard pass/fail?

[lestrrat]

Well, it's not strictly a requirement per the RFC, but as you may have realized already, this module tries to err on the side of safety with the assumption that users will always shoot themselves in the foot. That's why there exists a default set of validations that also check for iat along with others, instead of, for example, allowing all JWTs by default.

We can always revisit, but for the time being that's the way it is.

[cscochris]

ok, fair enough. i created a PR to update the comments to reflect that, hope it's useful and thanks for a great library, i enjoy working with it.

#1216