Closed sriharan16 closed 1 year ago
@jpadilla @auvipy Kindly help here in validating and reviewing this PR.
@auvipy I have rebased as mentioned. Also not sure why requesting your review removed @jpadilla! Kindly verify the changes and also add @jpadilla again as a reviewer
Team(@jpadilla, @auvipy ),
Can you please review this !
ci triggerred
there is a bug report https://github.com/jpadilla/pyjwt/issues/814 , can you verify?
Replied there.
Handling 'ImmatureSignatureError' for issued_at time when it is a future time epoch.
When the
issued_at
time in the payload is greater than thecurrent time + leeway
then we can call it out asImmatureSignatureError
as we do for(nbf)
We have
nbf
in the payload but still, with propernbf
someone can call the API with improperiat
to fool the system.Example:
Here the token is valid from 14:48(as per
nbf
) and has an expiry range of 5min fromiat
which makes the token valid. But theiat
is less thannbf
which makes the token valid for 7mins instead of 5min. This should not happen as per contract but attackers may do something like this even makingiat
andexp
with the year 2023 which still makes the token valid.We can restrict the same way as we do for
nbf
.