Skip to content

Conversation

@klippx
Copy link
Contributor

@klippx klippx commented Jun 7, 2018

We have seen instances where expired? returns false but it actually is expired, and we think it might be due to time skew.

So, when checking if a token is expired, we should try to take time skew into consideration.

Ideally I would have had issued_at as part of the hash, since it should be read from the server. But for now I decided to calculate it (calculated_issued_at), I think it might be good enough.

@coveralls
Copy link

coveralls commented Jun 7, 2018

Pull Request Test Coverage Report for Build 637

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage remained the same at ?%

Totals Coverage Status
Change from base Build 625: 0.0%
Covered Lines:
Relevant Lines: 0

💛 - Coveralls

spec/oauth2/access_token_spec.rb:174:11: C: RSpec/NotToNot: Prefer not_to over to_not.
@klippx
Copy link
Contributor Author

klippx commented Jun 8, 2018

Closing this as the backwards calculation doesn't even work, we use Time.now + expires_in - expires_in which gives Time.now again, which means clock skew is always zero.

Real fix in #391

@klippx klippx closed this Jun 8, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants