Add a five minute buffer to all expiration checks

[theacodes]

No description provided.

[dhermes]

Isn't this already built in? From the oauth2client codebase:

CLOCK_SKEW_SECS = 300  # 5 minutes in seconds

[theacodes]

I left it out when I wrote this library. :)

[dhermes]

But that's built into the spec, i.e. it wasn't just a quirk of oauth2client.

[theacodes]

Which spec? I don't remember reading about that. I might have overlooked it.

There's also an internal debating on-going about what the interval should be. :)

[dhermes]

Not sure which spec? Tried googling just now and gave up.

[theacodes]

insert shruggie

[dhermes]

The JWT profile / ID token spec and the JWT spec mention "skew" but they don't give specific values. For example:

The JWT MUST contain an "exp" (expiration time) claim that limits the time window during which the JWT can be used. The authorization server MUST reject any JWT with an expiration time that has passed, subject to allowable clock skew between systems. Note that the authorization server may reject JWTs with an "exp" claim value that is unreasonably far in the future.