Mismatch token timestamp web client and php server cause exception

[alexswe1]

I am using version 3.5 of the library. The issue is that the timestamp on the client with firebase web and the timestamp on the php server is mismatched and that causes an exception to be thrown when validating token in php. See details below:

On the client i get the token with:

fbase_auth.currentUser.getIdToken(true)
  .then((token) => {
        // return token
});

On the php server i run this code:

public function getUserFromTokenId($idTokenString) {
   $idToken = $this->auth->verifyIdToken($idTokenString);
   $uid = $idToken->getClaim('sub');			
   return $this->auth->getUser($uid);		
}

With the $idTokenString sent in from the client.

When running verifyIssuedAt in IdTokenVerifier class i get the error message:

"This token has been issued in the future."

The problem is that inside that code you have:

private function verifyIssuedAt(Token $token)   {
    if (!$token->hasClaim('iat'))  {            
        throw new InvalidIdToken('The claim "iat" is missing.');
     }

     if ($token->getClaim('iat') > time())  {  // this fails..			
        throw new InvalidIdToken('This token has been issued in the future.');        
   }    
}

The problem is as mentioned that the token from the client is in the future compared to the timestamp on the server. The test i ran the timestamp (from clock) on the server was 5 minutes slower then on client, so mismatch in timestamp caused it to not work (exception thrown)..

[jeromegamez]

Hey @alexswe1! Thank you for your report - this seems to be the same issue as in #140 - if you agree, I'd like to close this issue and we can continue the discussion over there, where I already added a proposal to work around this issue: #140 (comment)

[alexswe1]

Yes, same issue, although I reported it first.

[jeromegamez]

Continued in #140

[jeromegamez]

4.9.0 (Documentation) should fix the issue for special use cases.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.