Thalhammer
commented
2 years ago You should be able to change the verifier for the time related claims (nbf, iat, exp) to a noop, however I strongly recommend against this since it cause every token ever generated to be valid for ever, thus making it no better than a simple random password.
If you can in anyway, fix the clock issue (if you have network, this is easy, just query a ntp server. Simple ntp without delay correction is trivial and more than enough. I've done this before, its about 400lines max, or send the correct time in an earlier server response (if theres one).). If you can't fix the time, put an incrementing number in a claim and verify that the number never goes backwards or repeats, to prevent replay attacks.
with_claim accepts a std::function<void(const verify_ops::verify_context<json_traits>&, std::error_code& ec)> as second parameter, so something like this should work:
verifier.with_claim("iat", [](const verify_ops::verify_context<json_traits>&, std::error_code&) {})
// Same for nbf and exp
8vp
Hi,
We have a use case, where our token validation is failing on occasions. The reason is that our embedded device is subject to being set a wrong system time due to various factors and when this happens the interface function "explicit verifier(Clock c) : clock(c)" raises a token verification error - Line 2928.
In such cases, is there another interface we can use where the iat and the nbf checks can be disabled? Or a build flag to disable the check, to address such issues would be great many thanks.