Clock skew and tokens

Question

I need help to understand how clock skew works. We define clock skew to deal with time variation between two parties. But, my confusion is:

we have all information such as token created time and expiration time in the token itself
tokens can be validated
tokens are created on the server

So, why do we need clock skew? Can anyone give me the example for how it works and in which scenarios it can cause problems or benefits?

I had to setup to guarantee users who adjust computer clocks changing hour/minutes instead of setting up correct time zone (e.g. when DST starts, change hour to +1 instead of using DST flag or correct time zone) could still login to the website, it impacts token validation in browser because it makes computer UTC timestamps incorrect and then browsers see tokens always as expired. — Luizgrs, Nov 07 '17 at 11:38

score 12 · Answer 1 · answered Nov 07 '17 at 10:17

Lets consider a short lived access token. When I make a request to a server the server will check to see if my token has expired. How does it check that well it knows when the token was created and it knows what time it is now. Most access tokens expire after an hour but it really depends on how it was set up in the auth server. So if the token was created more than an hour ago its expired and the user is informed of that. This is why we try to ensure that servers are in sync with NTP.

Lets consider first what exactly is clock skew. What if we have two auth servers? How do you know that they will have the same time? What if they are in fact off by a few minutes. One server will return that the token has expired and the other wont. If you are a small company this probably doesn't matter.

Now consider if you are a big search engine company with servers all around the world. Lets say its the fall of 2016 and daylight savings time kicks in. Now you have some servers running on one time and others running at another. Maybe just maybe some country decides to change when they start daylight savings time and boom a bunch of tokens get invalidated for no reason. disclaimer I do not work for said search engine company. I just watched this happen and this is my theory as to what happened.

Why do we need clock skew.

You dont need it it but if you have two auth servers you could have it. So you should probably deal with it. https://softwareengineering.stackexchange.com/a/245182/160992

Nice answer but clock skew happens on same machine too. I had IdentityServer4 and desktop application using IdentityServer so both on same machine. IS4 was in localhost. The token was not expiring as per setup. It got fixed when added clock skew setting! Can you please advise something on this scenario? — newbeedeveloper, Nov 08 '17 at 14:05
@newbeedeveloper its happening to me on the same machine with ids4. what's the setting you changed to fix it? — Harindaka, May 14 '19 at 09:51

score 8 · Answer 2 · edited May 22 '22 at 19:43

8

Okay so clock skew is not happening in your machine. By default, clock skew is set to 5 minutes. This is the reason the JWT was not expiring at the desired time.

edited May 22 '22 at 19:43

Falcon Momot

1,065
8
20

answered Sep 04 '19 at 09:55

Manan Sheth

191
2
11

So when it will expire exactly? – variable Jan 05 '22 at 16:03

score 5 · Answer 3 · answered Oct 22 '21 at 16:06

There is a clock skew in the Microsoft JWT validation middleware. It is set by default to 5 mins and cannot be less (300 seconds/5 minutes)

There is a token validation parameter called ClockSkew, it gets or sets the clock skew to apply when validating a time. The default value of ClockSkew is 5 minutes. That means if you haven't set it, your token will be still valid for up to 5 minutes. If you want to expire your token on the exact time; you'd need to set ClockSkew to zero as follows,

 services.AddAuthentication("Bearer").AddJwtBearer("Bearer", options =>
        {
            options.Authority = "https://localhost:44347";
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateAudience = false,
                ValidateLifetime = true,
                ClockSkew = TimeSpan.Zero
            };
        });

You say "it cannot be less than 5 minutes", but then you set `ClockSkew` to `TimeSpan.Zero` later on. Could you elaborate? — display-name, Feb 02 '23 at 08:35

score 3 · Answer 4 · answered Jul 28 '21 at 09:24

This means setting a tolerance for the token expiration time in ValidateLifetime mode.ClockSkew means tolerance for this inconsistency (between the time and time of the token issuer and its consumer).

Clock skew amount specifies the allowed time difference (in seconds) between the server and client clocks when validating the exp and nbf claims. The recommended default value is 5.

Clock skew and tokens

4 Answers4

Linked