JWT authentication fails using Firebase - JWTIssuedAtFuture

Overview

If you authenticate using Firebase’s JWT as in this example or here, the following message will be output and it will fail.

Could not verify JWT: JWTIssuedAtFuture

Problems and suggestions

The interesting thing about this authentication failure is that if you make the same request several minutes after the authentication failure, the authentication will succeed.

Of course without changing the client program at all.

So I thought that the time zone was affecting, but the cause has not been identified yet. I am using Firebase in the region of asia-northeast1. Hasura is used by Docker, but the time zone looks like UTC. Is this relevant?

By the way, the Function registered in Firebase is the same as the sample.

Environment

docker:

• hasura: hasura/graphql-engine:v1.0.0-alpha41.cli-migrations
• postgres: postgres:11.1-alpine

[alexFaunt]

A Solution:

The allowed_skew property of the JWT settings allows you to configure the acceptable difference between clocks when comparing JWT times.

The docs only talk about expiry time, but I believe it applies to issue time too as setting this to 3s fixed the issue for me.

Hope that helps someone!

[brush701]

I was also having this issue, but found a solution. I’m running on WSL2, and interestingly there are clock-sync issues that arise. In my case, the WSL clock was a few seconds behind NTP time. Updating the Windows clock made no difference, but running ntpdate from the bash prompt worked like a charm. A simple workaround is to add sudo ntpdate -sb time.nist.gov to .bashrc and edit sudoers to grant permissions.