When using the supertokens-python backend, the session recipe sometimes raises an exception when validating the JWT claims: "The token is not yet valid (iat)".
This seems to be caused by clock drift between the core server, and my backend server - ie. the core server clock is slightly faster than my backend server clock.
The exception is raised by the pyJWT library, which is used by the supertokens-python library for validating the JWT claims.
A fix for this would be to allow setting some leeway in validating the at claim in the jwt. However, the current implementation doesn't allow this.
The relevant part of the code is the call to jwt.decode() in supertokens_python/recipe/session/access_token.py in the get_info_from_access_token() function, line 64.
The jwt.decode() function accepts a parameter named leeway, which is the number of seconds leeway to allow between the current time and the iat time.
Would it be possible to add an option to specify leeway, or add a fixed amount?
Or can you think of another fix for this?
For reference, in my testing I've found up to a few seconds difference in the clocks (running the backend server on my PC and on AWS EC2 instances)