search

simplesamlphp / simplesamlphp-test-framework

Test framework for SimpleSAMLphp and related repositories
GNU Lesser General Public License v2.1
0 stars 2 forks source link

InMemoryStore expiration off by 1? #5

Open pradtke opened 3 months ago

pradtke commented 3 months ago

In InMemoryStore (and my original version) we use

if (isset($item['expire']) && $item['expire'] < time()) {

for expiration check. I'm trying to fix some timing dependent tests in rate limiting and I found the rate limit tests assume that the store will expire the data on the expire time ( $item['expire'] <= time()) while the implementation of this store considers it valid on expire and expired 1 second later.

The phpdocs say int|null $expire – The expiration time (unix timestamp), or null if it never expires. which makes me think it should be considered expired on that time.

What do you think?

tvdijen commented 3 months ago

I've checked our other stores and they all follow the algorithm that if expire > now, the item is considered to be expired. So I think the logics are correct, but we need to clarify the phpdocs a bit more.