JWTDecode.swift icon indicating copy to clipboard operation
JWTDecode.swift copied to clipboard

Missing leeway as present on the Android SDK

Open ppamorim opened this issue 2 years ago • 0 comments

Checklist

  • [X] I have looked into the Readme and have not found a suitable solution or answer.
  • [X] I have searched the issues and have not found a suitable solution or answer.
  • [X] I have searched the Auth0 Community forums and have not found a suitable solution or answer.
  • [X] I agree to the terms within the Auth0 Code of Conduct.

Describe the problem you'd like to have solved

Hi,

I noted that the Swift version of this library doesn't contain the leeway value as it's present on the auth0/JWTDecode.Android:

https://github.com/auth0/JWTDecode.Android/blob/ec4b54496e684c5fb9e65f5ebb36e6241ef46161/lib/src/main/java/com/auth0/android/jwt/JWT.java#L161-L171

The issue in this source code can be found here: https://github.com/auth0/JWTDecode.swift/blob/75d29dcfc583d944dfe13fb2ff5de6e7a6c46902/JWTDecode/JWTDecode.swift#L54

Is that right? Shouldn't the libraries behave the same between the platforms?

Regards

Describe the ideal solution

Transform the value expired into a function that allow a leeway time, example:

struct JWT {

    var expiresAt: Date?
    //...

    var expired: Bool {
        self.expired()
    }

    func expired(leeway: Int = 0) -> Bool {
        guard let date = self.expiresAt else {
            return false
        }
        return date.compare(applyLeeway(Date(), leeway)) != ComparisonResult.orderedDescending
    }

    private func applyLeeway(_ date: Date, _ leeway: Int) -> Date {
        return date //// + leeway
    }

}

Alternatives and current workarounds

While it's possible to modify the expiredAt, I don't believe it should be done as it's modifying the JWT content.

Additional context

No response

ppamorim avatar Mar 12 '24 18:03 ppamorim