Add leeway to iat & exp claims
@@ -19,6 +19,8 @@ use webfinger::{Link, Relation};
/// The origin of the Google identity provider.
pub const GOOGLE_IDP_ORIGIN: &str = "https://accounts.google.com";
+/// The leeway allowed when verifying iat & exp claims, in seconds.
+pub const LEEWAY: i64 = 30;
/// Normalization to apply to an email address.
@@ -270,6 +272,8 @@ pub fn callback(ctx_handle: &ContextHandle) -> HandlerResult {
check_token_field!(token_addr == email_addr, "email", descr);
let now = now_utc().to_timespec().sec;
+ let exp = exp.checked_add(LEEWAY).unwrap_or(i64::min_value());
+ let iat = iat.checked_sub(LEEWAY).unwrap_or(i64::max_value());
check_token_field!(now < exp , "exp", descr);
check_token_field!(iat <= now, "iat", descr);
