[SYNCOPE-1179] JWT "Date" claims are interpreted using milliseconds instead of seconds

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.4
• Fix Version/s: 2.0.5, 2.1.0
• Assignee: Colm O hEigeartaigh
• Reporter: Colm O hEigeartaigh
• Created: 28/Jul/17 11:58
• Updated: 04/Sep/17 09:10
• Resolved: 28/Jul/17 13:50

Description

We currently treat (create + validate) JWT tokens with the claims "exp", "iat" and "nbf" as millisecond values. However the spec says that they should be seconds instead:

https://tools.ietf.org/html/rfc7519

NumericDate
A JSON numeric value representing the number of seconds from
1970-01-01T00:00:00Z UTC until the specified UTC date/time,
ignoring leap seconds.

exp: ... Its value MUST be a number
containing a NumericDate value.

nbf: ... Its value MUST be a number containing a
NumericDate value.

iat: ... Its
value MUST be a number containing a NumericDate value.