Merge pull request #609 from bp-xiao/feature/600-immature-signature-error

#600 Fix: Accept 10 seconds clock skew to avoid `ImmatureSignatureError`

Author: andyw8

CHANGELOG

@@ -1,4 +1,5 @@
 == Unreleased
+- Fix: Accept 10 seconds clock skew to avoid `ImmatureSignatureError`
 
 == Version 12.0.0
 - Update API version with 2022-04 release, remove API version 2021-07 ([#591](https://github.com/Shopify/shopify_python_api/pull/591))

shopify/session_token.py

@@ -14,6 +14,7 @@
 ALGORITHM = "HS256"
 PREFIX = "Bearer "
 REQUIRED_FIELDS = ["iss", "dest", "sub", "jti", "sid"]
+LEEWAY_SECONDS = 10
 
 
 class SessionTokenError(Exception):
@@ -54,6 +55,9 @@ def _decode_session_token(session_token, api_key, secret):
             secret,
             audience=api_key,
             algorithms=[ALGORITHM],
+            # AppBridge frequently sends future `nbf`, and it causes `ImmatureSignatureError`.
+            # Accept few seconds clock skew to avoid this error.
+            leeway=LEEWAY_SECONDS,
             options={"require": REQUIRED_FIELDS},
         )
     except jwt.exceptions.PyJWTError as exception:

test/session_token_test.py

@@ -48,7 +48,7 @@ def test_raises_if_token_authentication_header_is_not_bearer(self):
         self.assertEqual("The HTTP_AUTHORIZATION_HEADER provided does not contain a Bearer token", str(cm.exception))
 
     def test_raises_jwt_error_if_session_token_is_expired(self):
-        self.payload["exp"] = timestamp((datetime.now() + timedelta(0, -10)))
+        self.payload["exp"] = timestamp((datetime.now() + timedelta(0, -11)))
 
         with self.assertRaises(session_token.SessionTokenError) as cm:
             session_token.decode_from_header(self.build_auth_header(), api_key=self.api_key, secret=self.secret)
@@ -103,3 +103,8 @@ def test_returns_decoded_payload(self):
         )
 
         self.assertEqual(self.payload, decoded_payload)
+
+    def test_allow_10_seconds_clock_skew_in_nbf(self):
+        self.payload["nbf"] = timestamp((datetime.now() + timedelta(seconds=10)))
+
+        session_token.decode_from_header(self.build_auth_header(), api_key=self.api_key, secret=self.secret)