GAM-team / got-your-back

Got Your Back (GYB) is a command line tool for backing up your Gmail messages to your computer using Gmail's API over HTTPS.
https://github.com/GAM-team/got-your-back/wiki
Apache License 2.0
2.6k stars 205 forks source link

Reduce sensitivity of JWT `iat` check #343

Closed aaronadamsCA closed 2 years ago

aaronadamsCA commented 2 years ago

Full steps to reproduce the issue:

  1. Set your system clock back by 1 second
  2. Try to use any --action that calls verify_oauth2_token

Expected outcome (what are you trying to do?): Still works.

Actual outcome (what errors or bad behavior do you see instead?): ValueError: Token used too early, 1642758070 < 1642758071. Check that your computer's clock is set correctly.

If you could add clock_skew_in_seconds=10 to your calls you should be able to cut issue volume without sacrificing security. This option was added in 2.4.0 of the auth library: https://github.com/googleapis/google-auth-library-python/pull/894 - earlier versions had a baked-in value of 10 seconds, then there were a bunch of changes to the library that broke compatibility and for some reason they left the default in newer versions at 0, which breaks often in the real world.