Keats / jsonwebtoken

JWT lib in rust
MIT License
1.61k stars 253 forks source link

大佬看下,生成的token,我定了30秒有效期,超过了30秒怎么还能解码呢, #375

Closed pshuchuan closed 4 months ago

pshuchuan commented 4 months ago

[derive(Debug, Serialize, Deserialize)]

pub struct Claims { id:i32, email:String, exp: u64, }

pub fn token(id:i32,email:String) -> String{ let key = b"hmhometoken"; println!("加30秒之前:{}",Utc::now().timestamp()); let expiration_time = Utc::now() + Duration::try_seconds(20).unwrap();

let time =expiration_time.timestamp();
println!("加30秒之后:{}",time);
// let expiration_time = Utc::now() + Duration::days(365); 

let myclaims =
 Claims {
    id,
    email,
    exp:time as u64,
};
let header =Header { kid: Some("signing_key".to_owned()), alg: Algorithm::HS512, ..Default::default() };
// 生成令牌

println!("生成令牌:{}",Utc::now());
let token = match encode(&header,&myclaims,&EncodingKey::from_secret(key),) {
    Ok(t) => {
      t
    }
    Err(e) => {
        eprintln!("无法生成令牌: {}", e);
         format!("无法生成令牌:{}",e)} };
    token

}

pub fn parse_token(token: String) -> Result<Claims, MyError> { let key = b"hmhometoken"; let mut validation = Validation::new(Algorithm::HS512); validation.validate_exp = true;

decode::<Claims>(&token, &DecodingKey::from_secret(key), &validation)
    .map(|data| data.claims)
    .map_err(|e| MyError::new(format!("令牌验证失败: {}", e)))

}

Keats commented 4 months ago

Google translated the title but there is automatic leeway for the validation.

headironc commented 3 months ago

I have the same problem. During one minute after expiration, the token still works.

headironc commented 3 months ago

2024-03-25T16:58:07.508497Z DEBUG middlewares: Access token: eyJ0eXAiOiJKV1QiLCJhbGciOiJFZERTQSJ9.eyJleHAiOjE3MTEzODU4MzEsImlhdCI6MTcxMTM4NTUzMSwic3ViIjoiNjYwMDY2NTFlYzQ1YzY5NzJhNzlkZmI5In0.bA7NWrKaw8cMBid4gNQ89bAi83DFsS9kw0qVvaECoisuLl62AYZ6ecA-H5ce1DTuWFE4VPdb7OKf5tanAz1rDg 2024-03-25T16:58:07.512103Z DEBUG middlewares: Claims: Claims { exp: 1711385831, iat: 1711385531, sub: "66006651ec45c6972a79dfb9" }

headironc commented 3 months ago
Screenshot 2024-03-26 at 01 00 40
headironc commented 3 months ago
Screenshot 2024-03-26 at 00 58 54
headironc commented 3 months ago

Google translated the title but there is automatic leeway for the validation.

Oh, i see