Support id_token leeway #20
Conversation
| ... | ||
| }, | ||
| oidcClient: { | ||
| clockTolerance: 10 // In seconds. |
There was a problem hiding this comment.
According to their docs, it is in seconds.
leeway (Integer) A value in seconds; leeway to allow for clock skew with regard to JWT expiration times.
However, later in the oidc-client-settings file, it is referenced as milliseconds. So you may be correct.
Allowed leeway for id_tokens (in milliseconds).
I think the openid-client expects it in milliseconds, and auth0 sets leeway in seconds, so for consistency they did seconds and divided by 1000
client[custom.clock_tolerance] = clientSettings.clockTolerance / 1000;
There was a problem hiding this comment.
Correct, should be milliseconds to have a consistent way to express timespan (eg: on httpTimeout it's also MS).
There was a problem hiding this comment.
I updated the readme, thanks for letting me know.
Description
Add support for leeway when validating the
id_token. This is necessary when the time on your server is running behind on Auth0.References
#18