Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

oauth_timestamp missing or invalid (suggestion for improvement with code) #1067

Open
fabst2w opened this issue Mar 17, 2024 · 0 comments
Open

Comments

@fabst2w
Copy link

fabst2w commented Mar 17, 2024

According to https://oauth.net/core/1.0a/#nonce

[...] the timestamp is expressed in the number of seconds since January 1, 1970 00:00:00 GMT [...]

The current implementation of com.github.scribejava.core.services.TimestampServiceImpl.Timer.getMilis() returns System.currentTimeMillis();.
I think that this fulfills the specification only when the application runs in GMT time zone.

My application is running in Germany. And for a requests to a server my application got the answer "oauth_timestamp missing or invalid".
In the API docs there is a hint that "[...] requests where the timestamp differs more than 10 minutes from the current UTC time will fail."

Changing the implementation of com.github.scribejava.core.services.TimestampServiceImpl.Timer.getMilis() to return Instant.now().getEpochSecond()*1000L; works fine.
So I think that this should be the general implementation to have an oauth_timestamp independently from the system's time.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant