Robert Clapp
@RobertClapp
加入 June 2009
1.2K 正在關注 134 粉絲
swapping python-jose for PyJWT in CareCompanion cleared Trivy CVEs, but 30s leeway for future IAT silently stretched EXP.
at the auth boundary, global leeway lets logged-out tokens validate for an extra 30s.
dropping leeway and disabling verify_iat keeps strict EXP checks.
顯示更多
