Custom time skew for IdToken validation #1124
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Checklist
Motivation and Context
In MercadonaIT, we have found that the clock on some devices can exceed the default time skew value of 10 minutes.
As described in 3.1.3.7 Id Token Validation, Rule 10 indicates that the time skew range is client specific, but currently, the library does not provide options to modify it.
The goal of this change is to add the ability to disable or modify the allowed time skew for the
issued at (iat)
field of the ID Token.Description
I followed a similar approach as #662 already did for skipping the issuer https check.
Key changes:
setAllowedTimeSkew()
is added to modify the allowed time skew (default: 10 minutes).setSkipTimeValidation()
is added to completely disable time validation (recommended only for development environments).Example usage:
Modify the allowed time skew:
Disable time validation (for development only):