Skip to content

Commit 65ddea9

Browse files
jfromaniellojfromaniello
committed
Merge branch 'origin/clock_skew_tolerance' of https://github.com/jacopofar/node-jsonwebtoken into jacopofar-origin/clock_skew_tolerance
2 parents d78659f + ac7e6a6 commit 65ddea9

File tree

5 files changed

+77
-16
lines changed

5 files changed

+77
-16
lines changed

‎README.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -43,14 +43,16 @@ There are no default values for `expiresIn`, `notBefore`, `audience`, `subject`,
4343

4444
The header can be customized via the `option.header` object.
4545

46-
Generated JWTs will include an `iat` claim by default unless `noTimestamp` is specified.
46+
Generated jwts will include an `iat` (issued at) claim by default unless `noTimestamp` is specified. If `iat` is inserted in the payload, it will be used instead of the real timestamp for calculating other things like `exp` given a timespan in `options.expiresIn`.
4747

4848
Example
4949

5050
```js
5151
// sign with default (HMAC SHA256)
5252
var jwt = require('jsonwebtoken');
5353
var token = jwt.sign({ foo: 'bar' }, 'shhhhh');
54+
//backdate a jwt 30 seconds
55+
var older_token = jwt.sign({ foo: 'bar', iat: Math.floor(Date.now() / 1000) - 30 }, 'shhhhh');
5456

5557
// sign with RSA SHA256
5658
var cert = fs.readFileSync('private.key'); // get private key
@@ -81,6 +83,8 @@ encoded public key for RSA and ECDSA.
8183
* `ignoreExpiration`: if `true` do not validate the expiration of the token.
8284
* `ignoreNotBefore`...
8385
* `subject`: if you want to check subject (`sub`), provide a value here
86+
* `clockTolerance`: number of second to tolerate when checking the `nbf` and `exp` claims, to deal with small clock differences among different servers
87+
8488

8589
```js
8690
// verify a token symmetric - synchronous

‎index.js

+4-3
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ JWT.verify = function(jwtString, secretOrPublicKey, options, callback) {
135135
if (typeof payload.nbf !== 'number') {
136136
return done(new JsonWebTokenError('invalid nbf value'));
137137
}
138-
if (payload.nbf > Math.floor(Date.now() / 1000)) {
138+
if (payload.nbf > Math.floor(Date.now() / 1000) + (options.clockTolerance || 0)) {
139139
return done(new NotBeforeError('jwt not active', new Date(payload.nbf * 1000)));
140140
}
141141
}
@@ -144,8 +144,9 @@ JWT.verify = function(jwtString, secretOrPublicKey, options, callback) {
144144
if (typeof payload.exp !== 'number') {
145145
return done(new JsonWebTokenError('invalid exp value'));
146146
}
147-
if (Math.floor(Date.now() / 1000) >= payload.exp)
147+
if (Math.floor(Date.now() / 1000) >= payload.exp + (options.clockTolerance || 0)) {
148148
return done(new TokenExpiredError('jwt expired', new Date(payload.exp * 1000)));
149+
}
149150
}
150151

151152
if (options.audience) {
@@ -185,7 +186,7 @@ JWT.verify = function(jwtString, secretOrPublicKey, options, callback) {
185186
if (typeof payload.iat !== 'number') {
186187
return done(new JsonWebTokenError('iat required when maxAge is specified'));
187188
}
188-
if (Date.now() - (payload.iat * 1000) > maxAge) {
189+
if (Date.now() - (payload.iat * 1000) > maxAge + (options.clockTolerance || 0) * 1000) {
189190
return done(new TokenExpiredError('maxAge exceeded', new Date(payload.iat * 1000 + maxAge)));
190191
}
191192
}

‎sign.js

+13
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,13 @@ var sign_options_schema = Joi.object().keys({
1616
noTimestamp: Joi.boolean()
1717
});
1818

19+
var registered_claims_schema = Joi.object().keys({
20+
iat: Joi.number(),
21+
exp: Joi.number(),
22+
nbf: Joi.number()
23+
}).unknown();
24+
25+
1926
var options_to_payload = {
2027
'audience': 'aud',
2128
'issuer': 'iss',
@@ -44,6 +51,12 @@ module.exports = function(payload, secretOrPrivateKey, options, callback) {
4451
if (typeof payload === 'undefined') {
4552
throw new Error('payload is required');
4653
} else if (typeof payload === 'object') {
54+
var payload_validation_result = registered_claims_schema.validate(payload);
55+
56+
if (payload_validation_result.error) {
57+
throw payload_validation_result.error;
58+
}
59+
4760
payload = xtend(payload);
4861
} else if (typeof payload !== 'object') {
4962
var invalid_options = options_for_objects.filter(function (opt) {

‎test/iat.tests.js

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
var jwt = require('../index');
2+
var expect = require('chai').expect;
3+
4+
describe('iat', function() {
5+
6+
it('should work with a numeric iat not changing the expiration date', function () {
7+
var token = jwt.sign({foo: 123, iat: Math.floor(Date.now() / 1000) - 30}, '123', { expiresIn: 10 });
8+
var result = jwt.verify(token, '123');
9+
expect(result.exp).to.be.closeTo(Math.floor(Date.now() / 1000) + 10, 0.2);
10+
});
11+
12+
13+
it('should throw if iat is not a number', function () {
14+
expect(function () {
15+
jwt.sign({foo: 123, iat:'hello'}, '123');
16+
}).to.throw(/"iat" must be a number/);
17+
});
18+
19+
20+
});

‎test/verify.tests.js

+35-12
Original file line numberDiff line numberDiff line change
@@ -15,16 +15,16 @@ describe('verify', function() {
1515
var payload = { iat: Math.floor(Date.now() / 1000 ) };
1616

1717
var signed = jws.sign({
18-
header: header,
18+
header: header,
1919
payload: payload,
2020
secret: priv,
2121
encoding: 'utf8'
2222
});
2323

2424
jwt.verify(signed, pub, {typ: 'JWT'}, function(err, p) {
25-
assert.isNull(err);
26-
assert.deepEqual(p, payload);
27-
done();
25+
assert.isNull(err);
26+
assert.deepEqual(p, payload);
27+
done();
2828
});
2929
});
3030

@@ -50,7 +50,7 @@ describe('verify', function() {
5050
// { foo: 'bar', iat: 1437018582, exp: 1437018583 }
5151
var token = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmb28iOiJiYXIiLCJpYXQiOjE0MzcwMTg1ODIsImV4cCI6MTQzNzAxODU4M30.NmMv7sXjM1dW0eALNXud8LoXknZ0mH14GtnFclwJv0s';
5252
var key = 'key';
53-
53+
5454
var clock;
5555
afterEach(function () {
5656
try { clock.restore(); } catch (e) {}
@@ -70,9 +70,20 @@ describe('verify', function() {
7070
});
7171
});
7272

73-
it('should not error on unexpired token', function (done) {
74-
clock = sinon.useFakeTimers(1437018582000);
75-
var options = {algorithms: ['HS256']}
73+
it('should not error on expired token within clockTolerance interval', function (done) {
74+
clock = sinon.useFakeTimers(1437018584000);
75+
var options = {algorithms: ['HS256'], clockTolerance: 100}
76+
77+
jwt.verify(token, key, options, function (err, p) {
78+
assert.isNull(err);
79+
assert.equal(p.foo, 'bar');
80+
done();
81+
});
82+
});
83+
84+
it('should not error if within maxAge timespan', function (done) {
85+
clock = sinon.useFakeTimers(1437018582500);
86+
var options = {algorithms: ['HS256'], maxAge: '600ms'};
7687

7788
jwt.verify(token, key, options, function (err, p) {
7889
assert.isNull(err);
@@ -95,10 +106,22 @@ describe('verify', function() {
95106
done();
96107
});
97108
});
109+
110+
it('should not error for claims issued before a certain timespan but still inside clockTolerance timespan', function (done) {
111+
clock = sinon.useFakeTimers(1437018582500);
112+
var options = {algorithms: ['HS256'], maxAge: '321ms', clockTolerance: 100};
113+
114+
jwt.verify(token, key, options, function (err, p) {
115+
assert.isNull(err);
116+
assert.equal(p.foo, 'bar');
117+
done();
118+
});
119+
});
120+
98121
it('should not error if within maxAge timespan', function (done) {
99122
clock = sinon.useFakeTimers(1437018582500);
100123
var options = {algorithms: ['HS256'], maxAge: '600ms'};
101-
124+
102125
jwt.verify(token, key, options, function (err, p) {
103126
assert.isNull(err);
104127
assert.equal(p.foo, 'bar');
@@ -108,7 +131,7 @@ describe('verify', function() {
108131
it('can be more restrictive than expiration', function (done) {
109132
clock = sinon.useFakeTimers(1437018582900);
110133
var options = {algorithms: ['HS256'], maxAge: '800ms'};
111-
134+
112135
jwt.verify(token, key, options, function (err, p) {
113136
assert.equal(err.name, 'TokenExpiredError');
114137
assert.equal(err.message, 'maxAge exceeded');
@@ -121,7 +144,7 @@ describe('verify', function() {
121144
it('cannot be more permissive than expiration', function (done) {
122145
clock = sinon.useFakeTimers(1437018583100);
123146
var options = {algorithms: ['HS256'], maxAge: '1200ms'};
124-
147+
125148
jwt.verify(token, key, options, function (err, p) {
126149
// maxAge not exceded, but still expired
127150
assert.equal(err.name, 'TokenExpiredError');
@@ -136,7 +159,7 @@ describe('verify', function() {
136159
clock = sinon.useFakeTimers(1437018582900);
137160
var token = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmb28iOiJiYXIifQ.0MBPd4Bru9-fK_HY3xmuDAc6N_embknmNuhdb9bKL_U';
138161
var options = {algorithms: ['HS256'], maxAge: '1s'};
139-
162+
140163
jwt.verify(token, key, options, function (err, p) {
141164
assert.equal(err.name, 'JsonWebTokenError');
142165
assert.equal(err.message, 'iat required when maxAge is specified');

0 commit comments

Comments
 (0)