feat: Add jwt leeway configuration option#214
Conversation
|
👍 for this, though the failing test seems related isn't it? Can you please have a look? |
|
Failure is not related actually. I'm going to have a look asap, help welcome. |
|
Failure fixed, rebase needed :) |
Hey, thanks for the test fix. It seems to have improved a lot but not all the way. Looking at your PR for the fix, that's also not green yet. |
|
Remaining failures need some work to go away, not right now :) Can you add a test case for this? |
Added an acceptance test. I had a bit of struggles with the cache in |
|
@frankdekker Already suffered from this as well, we should do something to improve the situation. All good here |
0c8a1c1 to
c84131b
Compare
|
Thank you @frankdekker. |
When a jwt token is created on one server and then used on another, there might be a slight time difference in the jwt token timestamp. However the jwt validation is by default set to
PT0Sleeway and rejects the jwt token.The league/oauth2-server uses lcobucci/jwt for jwt creation and validation. There's an option to set the jwt leeway. See
the constructor of https://github.com/thephpleague/oauth2-server/blob/master/src/AuthorizationValidators/BearerTokenValidator.php
However there is no way to set this value via the oauth2-server-bundle. This PR allows to set this value.