search

mattbrailsford / umbraco-authu

An Umbraco plugin to add an OAuth API endpoint to allow authenticated Members/Users via OAuth
MIT License
71 stars 22 forks source link

ClockSkew makes token not expire #25

Closed tobbbe closed 6 years ago

tobbbe commented 6 years ago

As per https://stackoverflow.com/questions/39728519/jwtsecuritytoken-doesnt-expire-when-it-should.

If you have short access_token lifetime (2min ex) they wont expire until 5min.

Setting ClockSkew to 0 TimeSpan.Zero fixes this:

var tokenValidationParameters = new TokenValidationParameters
{
    //...your setting

    // set ClockSkew is zero
    ClockSkew = TimeSpan.Zero
};

An alternative would be to allow to configure all TokenValidationParameters in setup? I could make a PR for that :)

mattbrailsford commented 6 years ago

Fixed in commit ce1632b