Skip to content

Disable verify_iat

Artur Frysiak requested to merge (removed):issue-417543 into master

What does this MR do and why?

Since ruby-jwt 2.2.0 iat is checked without leeway, which can fail if clocks are slightly desynchronised.

IAT_LEEWAY constant is renamed, because leeway parameter in JWT.decode is applied only for nbf and exp fields.

Closes #417543 (closed)

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports

Loading