diff options
Diffstat (limited to 'packages/meshbay-node/src/meshbay_node')
| -rw-r--r-- | packages/meshbay-node/src/meshbay_node/hub_client.py | 4 | ||||
| -rw-r--r-- | packages/meshbay-node/src/meshbay_node/revocation.py | 2 |
2 files changed, 5 insertions, 1 deletions
diff --git a/packages/meshbay-node/src/meshbay_node/hub_client.py b/packages/meshbay-node/src/meshbay_node/hub_client.py index 1e975fa..8873958 100644 --- a/packages/meshbay-node/src/meshbay_node/hub_client.py +++ b/packages/meshbay-node/src/meshbay_node/hub_client.py @@ -129,7 +129,9 @@ class HubClient: access_token = data["access_token"] - decoded = jwt.decode(access_token, hub_pk_pem, algorithms=["EdDSA"]) + from meshbay_common.handshake import JWT_LEEWAY_SECONDS + decoded = jwt.decode(access_token, hub_pk_pem, algorithms=["EdDSA"], + leeway=JWT_LEEWAY_SECONDS) # No pk_user claim to check any more: tokens carry no key. What binds this # token to this node is the Ed25519 challenge it was issued against. assert "jti" in decoded, "Hub token missing jti — hub is outdated" diff --git a/packages/meshbay-node/src/meshbay_node/revocation.py b/packages/meshbay-node/src/meshbay_node/revocation.py index abbff4d..d3ee18f 100644 --- a/packages/meshbay-node/src/meshbay_node/revocation.py +++ b/packages/meshbay-node/src/meshbay_node/revocation.py @@ -66,7 +66,9 @@ class RevocationSubscriber: def verify_and_apply(self, token: str) -> bool: """Verify a revocation token and apply it. Returns True if valid.""" try: + from meshbay_common.handshake import JWT_LEEWAY_SECONDS payload = jwt.decode(token, self._hub_pk_pem, algorithms=["EdDSA"], + leeway=JWT_LEEWAY_SECONDS, options={"verify_exp": False}) if payload.get("type") != "revocation": return False |