search

paragonie / paseto

Platform-Agnostic Security Tokens
https://paseto.io
Other
3.23k stars 108 forks source link

Format of the "exp" field #31

Closed kirushik closed 6 years ago

kirushik commented 6 years ago

There's an RFC 3339 specifying timestamps format for use in Internet protocols.

I think it's a good idea to: 1) explicitly state that "exp" (if present) contents MUST follow that RFC. 2) fix the examples and test vectors to conform with that RFC. Currently the examples in README contain "exp": "2039-01-01T00:00:00", which doesn't have a timezone offset specified, in violation of RFC 3339. As a consequence, RFC-conformant parsers will refuse to parse this timestamp (saying from my personal experience, trying to implement PAST in Rust language).

paragonie-scott commented 6 years ago

Good catch. I totally didn't remember the timestamp part when writing these examples.

For what it's worth, we're using \DateTime::ATOM as the format when serializing datetime objects: https://3v4l.org/oMKMS

I'll update the test vectors and examples.

paragonie-scott commented 6 years ago

Fixed in https://github.com/paragonie/past/commit/a37b5a889e33cda2d923e880962ccc6fe3b449b8 :)

minus7 commented 6 years ago

Interestingly the JWT RFC 7159 demands a NumericDate (aka unix timestamp).

paragonie-scott commented 6 years ago

This is one of the many things PASETO is going to do right that JOSE does wrong.

(That's why I used 2039 in the test vectors.)