firebase-admin-python icon indicating copy to clipboard operation
firebase-admin-python copied to clipboard

A way to provide clock_skew_in_seconds

Open fatadel opened this issue 3 years ago • 2 comments

The method verify_token - https://github.com/firebase/firebase-admin-python/blob/6d826fd15c87db62f7501f569b6e0a762d17a05e/firebase_admin/_token_gen.py#L392 - has an additional parameter called clock_skew_in_seconds - https://github.com/googleapis/google-auth-library-python/blob/87cd2455aca96ac3fbc4a8b2f8e4c0bba568a70b/google/oauth2/id_token.py#L114.

However, it is not possible to provide this parameter when verifying ID tokens - https://github.com/firebase/firebase-admin-python/blob/6d826fd15c87db62f7501f569b6e0a762d17a05e/firebase_admin/auth.py#L194

I have been recently having issues where validating tokens failed from time to time with a message "Token used too early", where the timestamps were having a difference of 1-3 seconds. I have patched the admin SDK with clock_skew_in_seconds=10 argument and the issue disappeared. I do understand that my server's time synchronization is the problem in first place but being able to provide existing parameters would also be extremely helpful.

fatadel avatar May 11 '22 17:05 fatadel

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

google-oss-bot avatar May 11 '22 17:05 google-oss-bot

@fatadel could you share how you patched the admin SDK to add clock_skew_in_seconds=10? I am having the same issue.

Courvoisier13 avatar Jul 08 '22 13:07 Courvoisier13