Now in seconds vs. milliseconds: IATError: Issued in the future about pyoidc HOT 2 CLOSED

If they send IAT claims that are milliseconds they directly violate RFC 7519. (https://www.rfc-editor.org/rfc/rfc7519.html#page-10 ) and the OIDC specification.

4.1.6. "iat" (Issued At) Claim

The "iat" (issued at) claim identifies the time at which the JWT was
issued. This claim can be used to determine the age of the JWT. Its
value MUST be a number containing a NumericDate value. Use of this
claim is OPTIONAL.

NumericDate
A JSON numeric value representing the number of seconds from
1970-01-01T00:00:00Z UTC until the specified UTC date/time,
ignoring leap seconds. This is equivalent to the IEEE Std 1003.1,
2013 Edition [POSIX.1] definition "Seconds Since the Epoch", in
which each day is accounted for by exactly 86400 seconds, other
than that non-integer values can be represented. See RFC 3339
[RFC3339] for details regarding date/times in general and UTC in
particular.

The OpenID Connect Core specification says the same:

iat
REQUIRED. Time at which the JWT was issued. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the date/time.

You could probably pass in a huge negative "skew" kwarg into the verify method to compensate for this failure of World Coins implementation. Or override the IDToken class and add your own method to allow milliseconds.

from pyoidc.

Thanks for the info!

from pyoidc.