gin-jwt should set the TimeFunc in jwt-go
- Dominant language
- Go
- Stars
- 3k
- Forks
- 387
- Avg merge
- 4h 16m
- Merged PRs (30d)
- 1
Description
Both the gin-jwt library and the underlying jwt-go support a `TimeFunc`. By default, they are both initialized to `time.Now`.
https://github.com/appleboy/gin-jwt/blob/v2.6.4/auth_jwt.go#L272:
```go
if mw.TimeFunc == nil {
mw.TimeFunc = time.Now
}
```
https://github.com/dgrijalva/jwt-go/blob/v3.2.0/token.go#L13:
```go
// TimeFunc provides the current time when parsing token to validate "exp" claim (expiration time).
// You can override it to use another time value. This is useful for testing or if your
// server uses a different time zone than your tokens.
var TimeFunc = time.Now
```
gin-jwt should ensure that `TimeFunc` of each library are the same. If the two functions are not the same, it's possible for [gin-jwt to create a token with an expiration date](https://github.com/appleboy/gin-jwt/blob/v2.6.4/auth_jwt.go#L454) that is then falsely [invalidated by jwt-go](https://github.com/dgrijalva/jwt-go/blob/v3.2.0/claims.go#L34) when the user of gin-jwt provides a custom `TimeFunc`.
# Proposed Solution
The proposed solution is to simply add a line in the first snipped shown above to the following:
```go
if mw.TimeFunc == nil {
mw.TimeFunc = time.Now
}
jwt.TimeFunc = mw.TimeFunc // proposed line
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in auth_jwt.go at the middleware initialization block cited in the issue, then inspect jwt-go's TimeFunc and the token creation and validation paths referenced above. Ensure a custom middleware TimeFunc is used consistently by both libraries, and verify the existing test suite covers expiration behavior with a custom time function.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 50/100