Merge pull request #196 from oat-sa/fix/AUT-4031/leeway-set-for-token…

…-validation fix: Set leeway value to 1s for token validation
oat-sa · Jan 3, 2025 · 9858265 · 9858265
2 parents 39dbc68 + 6481380
commit 9858265
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/src/Security/Jwt/Configuration/ConfigurationFactory.php b/src/Security/Jwt/Configuration/ConfigurationFactory.php
@@ -22,6 +22,7 @@
 
 namespace OAT\Library\Lti1p3Core\Security\Jwt\Configuration;
 
+use DateInterval;
 use Lcobucci\Clock\SystemClock;
 use Lcobucci\JWT\Configuration;
 use Lcobucci\JWT\Encoding\JoseEncoder;
@@ -60,7 +61,7 @@ public function create(?KeyInterface $signingKey = null, ?KeyInterface $verifica
         );
 
         $configuration->setValidationConstraints(
-            new LooseValidAt(SystemClock::fromUTC()),
+            new LooseValidAt(SystemClock::fromUTC(), new DateInterval('PT1S')),
             new SignedWith($configuration->signer(), $configuration->verificationKey())
         );