FirebaseIdToken::Signature.verify(token) returns nil for newly issued tokens
dps opened this issue · 1 comments
dps commented
Using this library, newly issued tokens don't verify correctly until one second after they have been issued.
Found using a client example which did a forceRefresh on the token every time - had a timing dependent bug where these tokens sometimes verified OK but mostly didn't.
def still_valid?(payload)
payload['exp'].to_i > Time.now.to_i &&
payload['iat'].to_i < Time.now.to_i
end
Should be payload['iat'].to_i <= Time.now.to_i
fschuindt commented
Thank you for spotting it.
Your PR was approved and merged.
A new version is on the web.
https://github.com/fschuindt/firebase_id_token/releases/tag/2.1.0
Cheers!