From f26b63089abaa127625e99fe79240e8da533c63e Mon Sep 17 00:00:00 2001
From: Marius van der Wijden <m.vanderwijden@live.de>
Date: Thu, 28 Jul 2022 08:30:50 +0200
Subject: [PATCH] node: set JWT expiry to 60 seconds (#25416)

* node: set JWT expiry to 60 seconds

* node: rename var
---
 node/jwt_handler.go   | 6 ++++--
 node/rpcstack_test.go | 4 ++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/node/jwt_handler.go b/node/jwt_handler.go
index 28d5b87c6..363f6b3aa 100644
--- a/node/jwt_handler.go
+++ b/node/jwt_handler.go
@@ -24,6 +24,8 @@ import (
 	"github.com/golang-jwt/jwt/v4"
 )
 
+const jwtExpiryTimeout = 60 * time.Second
+
 type jwtHandler struct {
 	keyFunc func(token *jwt.Token) (interface{}, error)
 	next    http.Handler
@@ -68,9 +70,9 @@ func (handler *jwtHandler) ServeHTTP(out http.ResponseWriter, r *http.Request) {
 		http.Error(out, "token is expired", http.StatusForbidden)
 	case claims.IssuedAt == nil:
 		http.Error(out, "missing issued-at", http.StatusForbidden)
-	case time.Since(claims.IssuedAt.Time) > 5*time.Second:
+	case time.Since(claims.IssuedAt.Time) > jwtExpiryTimeout:
 		http.Error(out, "stale token", http.StatusForbidden)
-	case time.Until(claims.IssuedAt.Time) > 5*time.Second:
+	case time.Until(claims.IssuedAt.Time) > jwtExpiryTimeout:
 		http.Error(out, "future token", http.StatusForbidden)
 	default:
 		handler.next.ServeHTTP(out, r)
diff --git a/node/rpcstack_test.go b/node/rpcstack_test.go
index 58a022340..6fb16c504 100644
--- a/node/rpcstack_test.go
+++ b/node/rpcstack_test.go
@@ -356,11 +356,11 @@ func TestJWT(t *testing.T) {
 	expFail := []func() string{
 		// future
 		func() string {
-			return fmt.Sprintf("Bearer %v", issueToken(secret, nil, testClaim{"iat": time.Now().Unix() + 6}))
+			return fmt.Sprintf("Bearer %v", issueToken(secret, nil, testClaim{"iat": time.Now().Unix() + int64(jwtExpiryTimeout.Seconds()) + 1}))
 		},
 		// stale
 		func() string {
-			return fmt.Sprintf("Bearer %v", issueToken(secret, nil, testClaim{"iat": time.Now().Unix() - 6}))
+			return fmt.Sprintf("Bearer %v", issueToken(secret, nil, testClaim{"iat": time.Now().Unix() - int64(jwtExpiryTimeout.Seconds()) - 1}))
 		},
 		// wrong algo
 		func() string {