boulder icon indicating copy to clipboard operation
boulder copied to clipboard

gRPC: reject request if clock skew is too large

Open aarongable opened this issue 1 year ago • 0 comments

Have our gRPC server interceptor check for excessive clock skew between its own clock and gRPC client clocks. Do this by taking advantage of the client request timestamp that most clients already supply for the purpose of measuring cross-service latency. If the included timestamp is more than 10 minutes from the gRPC server's local time, immediately error out.

Add a unit test to check this behavior. Also update small bits of the integration tests to ensure that they comply with this new requirement.

Fixes https://github.com/letsencrypt/boulder/issues/7684

aarongable avatar Aug 27 '24 23:08 aarongable