google-api-go-client icon indicating copy to clipboard operation
google-api-go-client copied to clipboard

idtoken caching does not handle missing age in http response header

Open eytankidron opened this issue 3 years ago • 0 comments

In function calculateExpireTime (see https://github.com/googleapis/google-api-go-client/blob/977e871dbc6d880fa2392250a3d177598976b3d0/idtoken/cache.go#L98-L119) the code expects the "age" field to be present, otherwise the caching expiration is set to "now", which effectively means that the response is not cached.

According to https://httpwg.org/specs/rfc9111.html#age.calculations, a missing "age" field in the response header should be allowed and treated as if it was 0. So I think we should allow it to be missing.

eytankidron avatar Oct 14 '22 20:10 eytankidron