nbf validation fails when a non-integer value is passed in
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- javascript, node.js
- Domain
- authentication, backend, security
Research direction
Start at verify.js around line 50 and reproduce the fractional nbf example from the issue. Check the nbf validation against the current timestamp; done means a valid token with a non-integer nbf is not rejected because the clock value was rounded down.
Written by the indexing model from the issue text.
Description
Rounding down the current time when validating the nbf claim can result in a valid token being rejected if the nbf value is non-integer.
https://github.com/auth0/node-jsonwebtoken/blob/74d5719bd03993fcf71e3b176621f133eb6138c0/verify.js#L50
Example:
nbf = 1_646_822_341.111
Date.now() = 1_646_822_341_999
clockTimestamp = Math.floor(Date.now() / 1000) = 1_646_822_341
nbf > clockTimestamp
- Dominant language
- JavaScript
- Stars
- 18.2k
- Forks
- 1.3k
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from auth0/node-jsonwebtoken
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
auth0/node-jsonwebtoken#1042 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
auth0/node-jsonwebtoken#1000 · 2 comments · 1 reaction ·
-
Difficulty 4/5 3-5 days Newbie friendliness 65/100
auth0/node-jsonwebtoken#1046 ·
-
Difficulty 5/5 Over a week Newbie friendliness 10/100
auth0/node-jsonwebtoken#1034 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
auth0/node-jsonwebtoken#1032 ·
All issues in auth0/node-jsonwebtoken
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
antfu-collective/icones#398 ·
-
ECmail.com Open
Difficulty 1/5 Under an hour Newbie friendliness 90/100
wesbos/burner-email-providers#554 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
radiantearth/stac-browser#1023 ·
-
HMR stops working Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
components-web-app/docs#92 ·