Closed adrianocr closed 3 years ago
clocks are notoriously difficult to synchronize, I recommend to set nbf 1-3 minutes before current time when generating the token
@pkieltyka that's not a valid solution. I don't have access to Shopify's token generation so how am I supposed to set the NBF field to 1-3 mins back? If I were generating the token myself, sure, but I'm not.
Ideally this middleware should allow for specifying a "grace period" of sorts. Is that not feasible?
I see. You can implement the grace period yourself in this instance, write a middleware handler to check nbf and sleep for few seconds if you need the buffer. This isn't a bug report, and my bandwidth is limited to offer further help
It seems to me like this actually is a bug, and not simply an implementation issue. If I try to manually get around the problem it still fails because the verifier seems to kick up a problem with the nbf field even before it gets to the authenticator function. Additionally I wanted to make sure so I tested it repeatedly and here you'll see time.Now().UTC()
is in fact after the nbf time, yet it still fails:
2021/01/06 17:45:01 nbf: 2021-01-06 22:44:32 +0000 UTC, now: 2021-01-06 22:45:01 +0000 UTC
2021/01/06 17:45:05 nbf: 2021-01-06 22:44:32 +0000 UTC, now: 2021-01-06 22:45:05 +0000 UTC
2021/01/06 17:46:03 nbf: 2021-01-06 22:46:03 +0000 UTC, now: 2021-01-06 22:46:03 +0000 UTC
Those are all instances where the nbf check failed, yet the server time was after the nbf time. So what am I missing here?
The JWT look like this:
I dev apps for a service (Shopify) that lets you request a JWT from their servers, and then you can use that JWT to make authenticated calls to your backend (since the token is signed with your API secret, which both you and Shopify have on hand). My backend uses this JWT middleware to handle that part.
The issue I'm having is that it seems if I request a JWT and immediately use it to make a call to my backend (we're talking sub 50 milliseconds between getting the JWT and making a request to my backend), the JWT middleware returns the following error:
token nbf validation failed
If I then use a
setTimeout()
function on my frontend to add a 750-1000ms delay after requesting the JWT, the issue does not happen. So it seems to me like there's something going on with the underlying library/implementation that causes the backend to think it hasn't reached the correct NBF time yet?Not sure how I would go about resolving this other than manually adding delays before making calls to my backend. Suggestions?