我正在尝试通过以下方式向使用jwcrypto库生成的JWE添加到期时间
from jwcrypto import jwe, jwk, jwt
from datetime import datetime, timedelta
import time
# create JWK from existing key
jwk_str = '{"k":"29Js2yXM6P_4v9K1mHDlYVHw8Xvm_GEhvMTvKTRLRzY","kty":"oct"}'
jwk_key = jwk.JWK.from_json(jwk_str)
# calculate expiry time
d = datetime.now() + timedelta(seconds=5)
epoch = datetime.utcfromtimestamp(0)
total_seconds = (d - epoch).total_seconds()
# Add exp to the claims
claims={"exp": total_seconds, "sub": "Some random payload"}
print(claims)
jwttoken = jwt.JWT(header={"alg": "A256KW", "enc": "A256CBC-HS512"}, claims=claims)
jwttoken.make_encrypted_token(jwk_key)
jwetokenstr = jwttoken.serialize()
print(jwetokenstr)
# wait for 10 seconds to cross the expiry time
time.sleep(10)
jwttoken = jwt.JWT()
jwttoken.deserialize(token, jwk_key) # Ideally this line should fail as expiry is reached but it doesn't
print(jwttoken.claims)
我正在获取有效负载,但是未读到到期声明,并且到期时也不会失败。 我在做什么错了?
答案 0 :(得分:1)
这最终减少为日期时间操作错误。
对JSON Web令牌的exp
声明应以到期时间的秒数填充。
datetime.now()
返回一个本地时间(不是UTC时间)datetime.datetime
对象。然后,上面的代码继续从0时元时间的UTC时间datetime.datetime
对象中减去此本地时间datetime.datetime
对象,并评估这两者之间的总秒数,以确定到期时间。 但是,因为这是将本地时间日期时间与 UTC时间日期时间进行比较,所以此处的秒数实际上与纪元时间相差您与UTC的本地时区差异的恒定因素。
例如,如果我居住的时间比UTC早5个小时,那么我实际上将使用的时间比我希望的实际时间短5 * 60 * 60
秒代码。
相反,您可以简单地使用round(time.time()) + x
,其中x
是JWT将来应该过期的秒数。 time.time()
从纪元返回秒数(但以浮点数形式,因此您需要四舍五入)。
例如:
from jwcrypto import jwe, jwk, jwt
from datetime import datetime, timedelta
import time
jwk_str = '{"k":"29Js2yXM6P_4v9K1mHDlYVHw8Xvm_GEhvMTvKTRLRzY","kty":"oct"}'
jwk_key = jwk.JWK.from_json(jwk_str)
jwt_valid_seconds = 3
expiry_time = round(time.time()) + jwt_valid_seconds
claims={"exp": expiry_time, "sub": "Some random payload"}
jwttoken = jwt.JWT(header={"alg": "A256KW", "enc": "A256CBC-HS512"}, claims=claims)
jwttoken.make_encrypted_token(jwk_key)
jwetokenstr = jwttoken.serialize()
jwttoken2 = jwt.JWT()
jwttoken2.deserialize(jwetokenstr, jwk_key)
print('This should succeed because we are deserializing immediately before the JWT has expired:')
print(jwttoken2.claims)
# Wait for the JWT to expire, and then extra time for the leeway.
leeway = 60
time.sleep(leeway + jwt_valid_seconds + 1)
jwttoken2 = jwt.JWT()
print('\nThis should fail due to the JWT expiring:')
jwttoken2.deserialize(jwetokenstr, jwk_key)
提供输出
(env) $ python jwe_expiry.py
This should succeed because we are deserializing immediately before the JWT has expired:
{"exp":1576737332,"sub":"Some random payload"}
This should fail due to the JWT expiring:
Traceback (most recent call last):
File "jwe_expiry.py", line 26, in <module>
jwttoken2.deserialize(jwetokenstr, jwk_key)
File "... python3.7/site-packages/jwcrypto/jwt.py", line 493, in deserialize
self._check_provided_claims()
File "... python3.7/site-packages/jwcrypto/jwt.py", line 370, in _check_provided_claims
self._check_default_claims(claims)
File "... python3.7/site-packages/jwcrypto/jwt.py", line 351, in _check_default_claims
self._check_exp(claims['exp'], time.time(), self._leeway)
File "... python3.7/site-packages/jwcrypto/jwt.py", line 333, in _check_exp
claim, limit, leeway))
jwcrypto.jwt.JWTExpired: Expired at 1576737332, time: 1576737392(leeway: 60)