[Bug]: Inconsistent use of TimeWindow

[addeeriksson1]

Contact Details

No response

Describe the bug

When calling Parse you can add a TimeWIndow to the options. Currently, this TImeWindow is used both as checking skew for iat and some kind of expiry check on the iat. As a user, these are two separate variables which I want to assign different values for.

It also seems that TimeWindow does not affect the exp of the dpop proof, which seems inconsistent.

Steps to reproduce the behavior

In our case we want to have a smaller clock skew compared to the expiration time. It is also very confusing and hard to debug in the case where exp is set to a value which is a further in the future than iat + TimeWindow.

OS

No response

Relevant log output

No response

Additional Notes

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[SalladinBalwer]

I have had a look at this issue and I believe this is due to poor wording in the ParseOptions documentation.

TimeWindow is only used to check for clock skew, it checks that iat is not too far into the future or too far back into the past.

exp is what is used to determine expiration time and should be able to be set further into the future than iat + TimeWindow (probably even recommended).

I think what should be done here is clarifying what TimeWindow is used for.