firebase / firebase/firebase-js-sdk
Auth SDK should attempt to detect clock skew
- Dominant language
- TypeScript
- Stars
- 5.1k
- Forks
- 1k
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 37
Description
### [REQUIRED] Describe your environment
* Operating System version: all
* Browser version: all
* Firebase SDK version: 9.x
* Firebase Product: auth
### [REQUIRED] Describe the problem
#### Steps to reproduce:
If a user has a computer with an incorrect clock then it's possible for `getIdToken()` to return an expired token as the token will appear to be valid locally but when sent to a server and processed with the Admin `verifyIdToken()` function it will be expired.
The Firebase Auth SDK could detect clock skew and alert the developer in two main ways:
- If a token appears to have **more** than 1 hour of validity then there's clearly something wrong.
- The client can inspect the `date` header from the API request that gets the token and make sure the client and server agree on the date.
This is a somewhat rare situation but it's happening on our site and probably happening to others as well.
#### Relevant Code:
```javascript
firebase.auth().currentUser.getIdToken(false);
```
Contributor guide
Assessment
This issue has not been assessed yet.