wps_forward_bot
🚀 New issue to wemake-services/django-modern-rest by @sobolevn
📝 `leeway` / `iat` checks are not consistent in JWT token (#1324)
Currently we do double validation of leeway and iat for tokens:
1.
django-modern-rest/dmr/security/jwt/token.py
Lines 97 to 104 in a2d44b1
Our way
2.
django-modern-rest/dmr/security/jwt/token.py
Lines 154 to 162 in a2d44b1
pyjwt way
The question is: do we really need to do this second validation here:
django-modern-rest/dmr/security/jwt/token.py
Line 257 in a2d44b1
Because it was just checked here:
django-modern-rest/dmr/security/jwt/token.py
Lines 236 to 242 in a2d44b1
Context:
• _validate_iat in jwt/api_jwt.py in pyjwt
This probably needs a rework to have a single source of truth. API breakage is allowed.
(please, do not take this issue before the 1st of September)
#bug #good_first_issue #help_wanted #security #opensource_september #django_modern_rest
sent via relator
1 · 202 ·