From 8f8c8a17c1e99b7c4db1dfe897dd34afd45778c4 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Wed, 7 Oct 2026 08:48:18 -0700 Subject: [PATCH] security: verify the configured filer token lifetimes --- weed/security/jwt_filer_provider_test.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/weed/security/jwt_filer_provider_test.go b/weed/security/jwt_filer_provider_test.go index c6393da97d..f2c4c598c9 100644 --- a/weed/security/jwt_filer_provider_test.go +++ b/weed/security/jwt_filer_provider_test.go @@ -4,6 +4,7 @@ import ( "os" "path/filepath" "testing" + "time" "github.com/seaweedfs/seaweedfs/weed/util" ) @@ -42,7 +43,9 @@ expires_after_seconds = 90 {"write", true, "side-write-key", "side-read-key", 30}, } { t.Run(tc.name, func(t *testing.T) { + before := time.Now() token := provider(tc.isWrite) + after := time.Now() claims := &SeaweedFilerClaims{} if _, err := DecodeJwt(SigningKey(tc.signedBy), token, claims); err != nil { t.Fatalf("token does not validate against the %s key: %v", tc.name, err) @@ -50,6 +53,10 @@ expires_after_seconds = 90 if claims.ExpiresAt == nil { t.Fatal("token never expires") } + expiresIn := claims.ExpiresAt.Time + if expiresIn.Before(before.Add(time.Duration(tc.expires-1)*time.Second)) || expiresIn.After(after.Add(time.Duration(tc.expires+1)*time.Second)) { + t.Fatalf("token expires at %v, want %ds after %v", expiresIn, tc.expires, before) + } if _, err := DecodeJwt(SigningKey(tc.otherKey), token, &SeaweedFilerClaims{}); err == nil { t.Fatal("token also validates against the other access level's key") }