In our use of the JWT library, we are not configuring any leeway in the NBF or IAT time checking.
If you JWT is generated 1 sec in advance of the server time, it will be rejected.
Add a default leeway, maybe configurable as a service parameter
Looks like 5 minutes should be a reasonable choice - the default in Kerberos and the limit in the Windows system
https://web.mit.edu/kerberos/krb5-1.5/krb5-1.5.4/doc/krb5-admin/Clock-Sk...
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windo...(v=ws.11)
Add code and tests
n/a
n/a
n/a
Needs review
2.0
Code