Fix clock skew calculations #158
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Previously, the clock skew adjusted in the wrong direction. It would cause us to consider credentials whose expiration time had already pass according to the system clock to still be sent to the server. This is the opposite of what we wanted to happen. This fixes it so that we report that credentials are expired slightly before the system clock thinks they've expired.
lukesneeringer
approved these changes
May 5, 2017
dhermes
reviewed
May 6, 2017
google/auth/credentials.py
Outdated
| @@ -58,7 +58,7 @@ def expired(self): | |||
| """ | |||
| # Err on the side of reporting expiration early so that we avoid | |||
| # the 403-refresh-retry loop. | |||
| adjusted_now = _helpers.utcnow() - _helpers.CLOCK_SKEW | |||
| adjusted_now = _helpers.utcnow() + _helpers.CLOCK_SKEW | |||
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
added 2 commits
May 8, 2017 09:31
tamakisquare
added a commit
to tamakisquare/Pyrebase
that referenced
this pull request
Jun 1, 2017
This library was impacted by a bug in "google-auth" v1.0.0, which is fixed in v1.0.1 googleapis/google-auth-library-python#158 This commit is for adopting "google-auth" v1.0.1 and also removing the code that was intended as a workaround to the bug.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Previously, the clock skew adjusted in the wrong direction. It would cause us to consider credentials whose expiration time had already passed according to the system clock to still be sent to the server. This is the opposite of what we wanted to happen. This fixes it so that we report that credentials are expired slightly before the system clock thinks they've expired.