From eb556c8cabd73d8af4088741a8171549d036c31e Mon Sep 17 00:00:00 2001 From: James Rowe Date: Mon, 2 Dec 2019 09:37:53 -0700 Subject: [PATCH] Force disable exp and nbf validation. Some clients had the wrong time information so it would fail to validate their token when installing. Remove these checks since they'll be checked on the server side anyway --- src/frontend/rest/services/authentication.rs | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/frontend/rest/services/authentication.rs b/src/frontend/rest/services/authentication.rs index 4364640..46e0efd 100644 --- a/src/frontend/rest/services/authentication.rs +++ b/src/frontend/rest/services/authentication.rs @@ -138,7 +138,7 @@ pub fn validate_token( }; // Configure validation for audience and issuer if the configuration provides it - let validation = match validation { + let mut validation = match validation { Some(v) => { let mut valid = Validation::new(Algorithm::RS256); valid.iss = v.iss; @@ -149,7 +149,8 @@ pub fn validate_token( } None => Validation::default(), }; - + validation.validate_exp = false; + validation.validate_nbf = false; // Verify the JWT token decode::(&body, pub_key.as_slice(), &validation) .map(|tok| tok.claims)