-
-
Notifications
You must be signed in to change notification settings - Fork 58
Description
Checklist
- Are you reporting a bug? Use github issues for bug reports and feature requests. For general questions, please use https://discuss.yjs.dev/
- Try to report your issue in the correct repository. Yjs consists of many modules. When in doubt, report it to https://github.com/yjs/yjs/issues/
Describe the bug
I believe the current implementation on exp claim is not conform to RFC 7519
[The "exp" (expiration time)] value MUST be a number containing a NumericDate value.
Also, the NumericDate value is described here
NumericDate
A JSON numeric value representing the number of seconds from
1970-01-01T00:00:00Z UTC until the specified UTC date/time,
ignoring leap seconds.
To Reproduce
Steps to reproduce the behavior:
- Generate a JWT using the RFC implementation of
exp - Try to connect to the y-redis server
- See error
Failed to auth to endpoint /y-redis-demo-app Error: Expired JWT
at Module.verifyJwt (file:///Users/naydenoff/dev/y-red-dve/y-redis/node_modules/lib0/crypto/jwt.js:51:11)
at async registerYWebsocketServer.redisPrefix.redisPrefix (file:///Users/naydenoff/dev/y-red-dve/y-redis/src/server.js:57:38)
at async upgrade (file:///Users/naydenoff/dev/y-red-dve/y-redis/src/ws.js:117:50)
Expected behavior
The exp field should be unix timestamp to match RFC 7519.
Screenshots
A screenshot showing the current expiration date being 4/25/56333

A screenshot showing the expected expiration date being 5/12/2024

(Yes, the token is meant to be valid 5s for test purposes in this screenshot)
Environment Information
- Browser / Node.js [e.g. Chrome, Firefox, Node.js]
Node 20 - Yjs version and the versions of the y-* modules you are using [e.g. yjs v13.0.1, y-webrtc v1.2.1]. Use
npm ls yjsto find out the exact version you are using.
@y/redis@1.5.3 /y-redis
├─┬ y-websocket@2.0.3
│ ├─┬ y-leveldb@0.1.2
│ │ └── yjs@13.6.15 deduped
│ ├─┬ y-protocols@1.0.6
│ │ └── yjs@13.6.15 deduped
│ └── yjs@13.6.15 deduped
└── yjs@13.6.15
Additional context
I understand that it does work if I generate a token with the expected exp of y-redis.
But as it is supposed to integrate with the user's server, I believe it's best if we respect the RFC so that anyone can just use the project without surprises.