The token is not valid yet

[rsajja79]

pylti1p3.exception.LtiException: Can't decode id_token: The token is not yet valid (iat)

I'm getting this error. Everytime I try to launch an app from canvas, this is the error I'm getting. It was working for a day or so, I changed some code in launch that deals with nrps to get the role of the user, I'm getting this error.

[hmoffatt]

It means the computer clocks are not synchronized. Use ntp.

[rsajja79]

Use NTP on the server where this flask application is running?

[hmoffatt]

You need the clocks properly synchronised everywhere - your Canvas server and your flask application server. The error means that there is a difference in the clocks and hence the application can't trust the token.

[sdiemer]

Hello,

I'm facing a similar issue but with servers having correct NTP configurations.
The problem is that the LMS servers are using different NTP servers than the application servers.
The LMS NTP server is in advance of ~0.15 seconds and then when requests are fast enough, the application throws the error The token is not yet valid (iat).
In my case, it is not possible to change the NTP servers used in all implied systems due to internal politics.
Could it be possible to pass the verify_iat setting to pyjwt (source) ?

Regards

[hmoffatt]

You can set the verify options already, by calling set_jwt_verify_options() on your message_launch object.
https://github.com/dmitry-viskov/pylti1.3/blob/master/pylti1p3/message_launch.py#L254

Rather than disabling the iat check altogether, I think what is needed is to add some leeway when calling jwt.decode, at https://github.com/dmitry-viskov/pylti1.3/blob/master/pylti1p3/message_launch.py#L715

Solutions are 1. patch the library, 2. extended MessageLaunch to override validate_jwt_signature to pass the leeway parameter, or 3. disable the built-in iat validation and do your own.

[rsajja79]

I agree with the response provided above. I was able to resolve the issue by adding the leeway parameter to the MessageLaunch. This adjustment accommodates the minor time discrepancy between the LMS and application servers without disabling the iat check altogether.

[hmoffatt]

I think it would be helpful for MessageLaunch to have a method to set the leeway passed to jwt.decode (set_jwt_verify_leeway perhaps), like it has set_jwt_verify_options.

[sdiemer]

Thank you for your responses.
I searched for explanation on the "leeway" setting of pyjwt, it seems it is only for the expiration date:
https://pyjwt.readthedocs.io/en/latest/usage.html#expiration-time-claim-exp
I will have to make some tests to able to choose a solution among the list you provided.
Regards

[hmoffatt]

I searched for explanation on the "leeway" setting of pyjwt, it seems it is only for the expiration date:

No, it is also applied to the iat validation, see the code: https://github.com/jpadilla/pyjwt/blob/master/jwt/api_jwt.py#L320