appleboy / appleboy/gin-jwt

gin-jwt should set the TimeFunc in jwt-go

Open
#266 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
3k
Forks
387
Avg merge
4h 16m
Merged PRs (30d)
1

Description

Both the gin-jwt library and the underlying jwt-go support a `TimeFunc`. By default, they are both initialized to `time.Now`.

https://github.com/appleboy/gin-jwt/blob/v2.6.4/auth_jwt.go#L272:
```go
if mw.TimeFunc == nil {
mw.TimeFunc = time.Now
}
```

https://github.com/dgrijalva/jwt-go/blob/v3.2.0/token.go#L13:
```go
// TimeFunc provides the current time when parsing token to validate "exp" claim (expiration time).
// You can override it to use another time value. This is useful for testing or if your
// server uses a different time zone than your tokens.
var TimeFunc = time.Now
```

gin-jwt should ensure that `TimeFunc` of each library are the same. If the two functions are not the same, it's possible for [gin-jwt to create a token with an expiration date](https://github.com/appleboy/gin-jwt/blob/v2.6.4/auth_jwt.go#L454) that is then falsely [invalidated by jwt-go](https://github.com/dgrijalva/jwt-go/blob/v3.2.0/claims.go#L34) when the user of gin-jwt provides a custom `TimeFunc`.

# Proposed Solution
The proposed solution is to simply add a line in the first snipped shown above to the following:

```go
if mw.TimeFunc == nil {
mw.TimeFunc = time.Now
}
jwt.TimeFunc = mw.TimeFunc // proposed line
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in auth_jwt.go at the middleware initialization block cited in the issue, then inspect jwt-go's TimeFunc and the token creation and validation paths referenced above. Ensure a custom middleware TimeFunc is used consistently by both libraries, and verify the existing test suite covers expiration behavior with a custom time function.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.