Commit e07793bd authored by Stan Hu's avatar Stan Hu

Fix broken time sync leeway with Geo

Previous versions did not properly set the IAT leeway properly, causing
many Geo API requests to be marked invalid. The problem was that
the ruby-jwt `master` used `iat_leeway` as the parameter, but v1.5.6
actually used `leeway`.
parent 9fd5c408
---
title: Fix broken time sync leeway with Geo
merge_request:
author:
......@@ -41,7 +41,7 @@ module Gitlab
encoded_message,
secret,
true,
{ iat_leeway: IAT_LEEWAY, verify_iat: true, algorithm: 'HS256' }
{ leeway: IAT_LEEWAY, verify_iat: true, algorithm: 'HS256' }
)
message = decoded.first
......
......@@ -27,10 +27,16 @@ describe Gitlab::Geo::JwtRequestDecoder do
expect(described_class.new(data).decode).to be_nil
end
it 'successfully decodes when clocks are off by IAT leeway' do
subject
Timecop.travel(30.seconds.ago) { expect(subject.decode).to eq(data) }
end
it 'returns nil when clocks are not in sync' do
allow(JWT).to receive(:decode).and_raise(JWT::InvalidIatError)
subject
expect(subject.decode).to be_nil
Timecop.travel(2.minutes.ago) { expect(subject.decode).to be_nil }
end
it 'raises invalid decryption key error' do
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment