From c10ba8e214c5e5f658d83e1517cb0d569afc8386 Mon Sep 17 00:00:00 2001
From: steve-chavez <stevechavezast@gmail.com>
Date: Thu, 27 Apr 2023 20:19:49 -0500
Subject: [PATCH] fix: skew of 30 seconds for JWT validation

---
 CHANGELOG.md          | 2 ++
 src/PostgREST/Auth.hs | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e76b14a10..e99521ee6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,8 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
  - #2762, Fixes "permission denied for schema" error during schema cache load - @steve-chavez
  - #2756, Fix bad error message on generated columns when using `Prefer: missing=default` - @steve-chavez
+ - #1139, Allow a 30 second skew for JWT validation - @steve-chavez
+   + It used to be 1 second, which was too strict
 
 ## [11.0.0] - 2023-04-16
 
diff --git a/src/PostgREST/Auth.hs b/src/PostgREST/Auth.hs
index 29521948b..26c3850b3 100644
--- a/src/PostgREST/Auth.hs
+++ b/src/PostgREST/Auth.hs
@@ -63,7 +63,7 @@ parseToken AppConfig{..} token time = do
   liftEither . mapLeft jwtClaimsError $ JSON.toJSON <$> eitherClaims
   where
     validation =
-      JWT.defaultJWTValidationSettings audienceCheck & set JWT.allowedSkew 1
+      JWT.defaultJWTValidationSettings audienceCheck & set JWT.allowedSkew 30
 
     audienceCheck :: JWT.StringOrURI -> Bool
     audienceCheck = maybe (const True) (==) configJwtAudience