FAPI2: test clock skew in request object
I don't think we test the clause being updated in this pull request: https://bitbucket.org/openid/fapi/pull-requests/497/diff
We should:
- try sending the AS a request object with nbf 10 seconds in the future and fail if it is not accepted
- try sending an exp more than 60 seconds in the future and warns if it is not accepted
- try sending an exp a year in the future and fail if it is accepted (there isn't normative text about this in the spec but it seems fairly clear that accepting a value a year in the future is obviously wrong)
Edited by Joseph Heenan