refactor!: set default clock skew tolerance to 15 seconds

BREAKING CHANGE: Default clock skew tolerance is now set to 15 seconds (previously 0 seconds tolerance). This can be reverted using the `clockTolerance` configuration option.
panva · Dec 1, 2022 · 42c00da · 42c00da
1 parent a66df23
commit 42c00da
Show file tree

Hide file tree

Showing 5 changed files with 4 additions and 5 deletions.
diff --git a/certification/fapi/index.js b/certification/fapi/index.js
@@ -167,7 +167,6 @@ const fapi = new Provider(ISSUER, {
     id_token_signed_response_alg: 'PS256',
     request_object_signing_alg: 'PS256',
   },
-  clockTolerance: 5,
   features: {
     ciba: {
       enabled: true,

diff --git a/docs/README.md b/docs/README.md
@@ -2088,7 +2088,7 @@ _**recommendation**_: Only set this to a reasonable value when needed to cover s
 
 _**default value**_:
 ```js
-0
+15
 ```
 
 ### conformIdTokenClaims

diff --git a/lib/helpers/defaults.js b/lib/helpers/defaults.js
@@ -674,7 +674,7 @@ function makeDefaults() {
      * recommendation: Only set this to a reasonable value when needed to cover server-side client and
      *   oidc-provider server clock skew.
      */
-    clockTolerance: 0,
+    clockTolerance: 15,
 
     /*
      * conformIdTokenClaims

diff --git a/test/client_auth/client_auth.test.js b/test/client_auth/client_auth.test.js
@@ -1023,7 +1023,7 @@ describe('client authentication options', () => {
         sub: 'client-jwt-secret',
         iss: 'client-jwt-secret',
       }, this.key, 'HS256', {
-        expiresIn: -1,
+        expiresIn: -300,
       }).then((assertion) => this.agent.post(route)
         .send({
           client_assertion: assertion,

diff --git a/test/sessions/sessions.test.js b/test/sessions/sessions.test.js
@@ -23,7 +23,7 @@ describe('session exp handling', () => {
     await this.login();
     const session = this.getSession();
     const oldSessionId = this.getSessionId();
-    session.exp = epochTime();
+    session.exp = epochTime() - 300;
 
     sinon.spy(this.TestAdapter.for('Session'), 'destroy');