Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

exp time not being properly calculated if setting iat #217

Closed
nickzelei opened this issue Jun 15, 2016 · 1 comment
Closed

exp time not being properly calculated if setting iat #217

nickzelei opened this issue Jun 15, 2016 · 1 comment

Comments

@nickzelei
Copy link

nickzelei commented Jun 15, 2016

The expected behavior as per the documentation is that if you "iat" flag is populated, it will calculate the "exp" time off of that, instead of the current time. This is not the case.

payload.exp = timespan(options.expiresIn);

The timestamp function does not take into account for modified issued at time.

The function should be modified somehow in this manner:

 module.exports = function (time, iat) {
   var timestamp = iat || Math.floor(Date.now() / 1000);

   if (typeof time === 'string') {
     var milliseconds = ms(time);
     if (typeof milliseconds === 'undefined') {
      return;
     }
     return Math.floor(timestamp + milliseconds / 1000);
   } else if (typeof time === 'number' ) {
     return timestamp + time;
   } else {
     return;
   }

 };

This would allow for passing in of the starting time so that the exp prop can be properly calculated instead of always calculating it based off the current time.

This issue arose when writing a test to verify an expired JWT and I back dated the issued at time by 20 minutes and set the expiresIn signing option for "15m".
I saw a valid "iat" of 20 minutes ago, but the "exp" to be 15 minutes from the current time, thus offering a "JWT" that was valid for 35 minutes.

@Pempti
Copy link

Pempti commented Jun 20, 2016

I tested this separately and can confirm this is the case. payload.exp is calculated as (currentTime + options.expiresIn). This is more obvious when you set payload.iat 20 minutes in the future (currentTime + 1200) and options.expiresIn to 15 minutes in the future (900). payload.exp will be less than payload.iat

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants