Google OAuth fails if server's clock is just few seconds ahead

[mattilindell]

Hi,

Google OAuth fails if client's system time is just few seconds ahead. Stormpath swallows the root cause, saing just "Token is invalid" without any additional info.

a) Can you make the time-checks less strict on Stormpath's side, allowing some time drifting on client's side b) Bubble up the actual error root cause to the callee.

Thanks, Matti

[robertjd]

Thanks for the report, is there more information in the error message, such as a status code? In addition to the Google access token, we also exchange our own tokens during the login flow, so it's possible there is also an issue with server time. I want to make sure we're looking in the right place.

[mattilindell]

Hi, this is not actually caused by client's clock, but server's clock instead.

[robertjd]

Thanks for the update, is your application now working with an updated server clock?

[mattilindell]

Yes it is.