Comments (2)
If they send IAT claims that are milliseconds they directly violate RFC 7519. (https://www.rfc-editor.org/rfc/rfc7519.html#page-10 ) and the OIDC specification.
4.1.6. "iat" (Issued At) Claim
The "iat" (issued at) claim identifies the time at which the JWT was
issued. This claim can be used to determine the age of the JWT. Its
value MUST be a number containing a NumericDate value. Use of this
claim is OPTIONAL.
NumericDate
A JSON numeric value representing the number of seconds from
1970-01-01T00:00:00Z UTC until the specified UTC date/time,
ignoring leap seconds. This is equivalent to the IEEE Std 1003.1,
2013 Edition [POSIX.1] definition "Seconds Since the Epoch", in
which each day is accounted for by exactly 86400 seconds, other
than that non-integer values can be represented. See RFC 3339
[RFC3339] for details regarding date/times in general and UTC in
particular.
The OpenID Connect Core specification says the same:
iat
REQUIRED. Time at which the JWT was issued. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the date/time.
You could probably pass in a huge negative "skew" kwarg into the verify method to compensate for this failure of World Coins implementation. Or override the IDToken class and add your own method to allow milliseconds.
from pyoidc.
Thanks for the info!
from pyoidc.
Related Issues (20)
- ERROR Wrong authentication method used: client_secret_post != client_secret_basic HOT 6
- Not able to find sp_config HOT 3
- Document release process / pypi upload HOT 2
- Create python 3.11 compatible release for pypi HOT 2
- Client.request_and_return no longer works with NoneResponse HOT 5
- Update conda-forge packages HOT 1
- Update URL references after repo move HOT 2
- AttributeError: 'dict' object has no attribute 'create_cookie' HOT 3
- Allow using different authn_method in Consumer.complete()
- Consumer.backchannel_logout and handling state HOT 11
- Architecture question regardings multiple app instances HOT 3
- Cannot add `scope` to registration request HOT 5
- Release 1.5.1 HOT 4
- Investigate failing readthedocs.io build HOT 1
- pydantic 2 seems to be incompatible with oic currently HOT 1
- Multiple matching kid support HOT 1
- Add support for RFC 9207 (?) HOT 1
- Why does `Client.do_access_token_refresh` require `state`? HOT 2
- Use SLSA workflow to create releases for PyPi HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from pyoidc.