Use timezone to instead of any seconds for clock skew.

m0ver · m0ver · commit 77e550a8eb67 · 2026-02-27T16:16:13.000+08:00
diff --git a/src/main/java/org/tinystruct/http/security/JWTManager.java b/src/main/java/org/tinystruct/http/security/JWTManager.java
@@ -7,6 +7,8 @@
 import javax.crypto.SecretKey;
 import java.time.Duration;
 import java.time.Instant;
+import java.time.ZoneId;
+import java.time.ZonedDateTime;
 import java.util.Base64;
 import java.util.Date;
 
@@ -18,7 +20,8 @@ public class JWTManager {
 
     /**
      * Sets the secret key using a plain text string.
-     * This method allows for a custom secret key to be used instead of the default one.
+     * This method allows for a custom secret key to be used instead of the default
+     * one.
      *
      * @param secret The secret key as a plain text string
      */
@@ -28,7 +31,8 @@ public void withSecret(String secret) {
 
     /**
      * Sets the secret key using a base64 encoded string.
-     * This method allows for a custom secret key to be used instead of the default one.
+     * This method allows for a custom secret key to be used instead of the default
+     * one.
      *
      * @param base64Secret The secret key as a base64 string
      */
@@ -37,20 +41,36 @@ public void withBase64Secret(String base64Secret) {
     }
 
     /**
-     * Sets the clock skew in seconds.
-     * This method allows for a leeway in the token's expiration time to account for clock differences between machines.
+     * Sets the timezone and calculates the clock skew in seconds.
+     * This method allows for a leeway in the token's expiration time to account for
+     * clock differences between machines.
      *
-     * @param clockSkew The clock skew in seconds
+     * @param zoneId The timezone ID
      */
-    public void withClockSkew(long clockSkew) {
-        this.clockSkew = clockSkew;
+    public void withTimezone(ZoneId zoneId) {
+        this.clockSkew = Duration.between(
+                ZonedDateTime.now(zoneId).toLocalDateTime(),
+                ZonedDateTime.now(ZoneId.systemDefault()).toLocalDateTime()).getSeconds();
     }
 
     /**
-     * Builds a JWT with the given subject and claims and returns it as a JWS signed compact String.
+     * Sets the timezone and calculates the clock skew in seconds.
+     * This method allows for a leeway in the token's expiration time to account for
+     * clock differences between machines.
      *
-     * @param subject The subject (typically the user identifier)
-     * @param builder A Builder object containing the claims to be included in the JWT
+     * @param timezone The timezone string
+     */
+    public void withTimezone(String timezone) {
+        this.withTimezone(ZoneId.of(timezone));
+    }
+
+    /**
+     * Builds a JWT with the given subject and claims and returns it as a JWS signed
+     * compact String.
+     *
+     * @param subject  The subject (typically the user identifier)
+     * @param builder  A Builder object containing the claims to be included in the
+     *                 JWT
      * @param validity The validity period of the token in hours
      * @return The generated JWT as a compact JWS signed String
      */
@@ -64,7 +84,8 @@ public String createToken(final String subject, final Builder builder, final lon
         // Add the claims from the builder to the JWT
         builder.forEach(jwtBuilder::claim);
 
-        // Sign the JWT with the provided secret key, or the default key if none provided
+        // Sign the JWT with the provided secret key, or the default key if none
+        // provided
         if (this.base64Key != null)
             jwtBuilder.signWith(this.base64Key);
         else
@@ -76,7 +97,8 @@ public String createToken(final String subject, final Builder builder, final lon
 
     /**
      * Parses the given JWS signed compact JWT, returning the claims.
-     * If this method returns without throwing an exception, the token can be trusted.
+     * If this method returns without throwing an exception, the token can be
+     * trusted.
      *
      * @param compactToken The JWT to be parsed
      * @return The claims contained in the JWT
diff --git a/src/test/java/org/tinystruct/http/security/JWTManagerTest.java b/src/test/java/org/tinystruct/http/security/JWTManagerTest.java
@@ -8,6 +8,8 @@
 import org.junit.jupiter.api.Test;
 import org.tinystruct.data.component.Builder;
 
+import java.time.ZoneId;
+
 import static org.junit.jupiter.api.Assertions.*;
 
 public class JWTManagerTest {
@@ -78,12 +80,13 @@ public void testTokenWithClockSkew() {
             e.printStackTrace();
         }
 
-        // Set clock skew to 60 seconds
-        jwtManager.withClockSkew(60);
+        // Set timezone to UTC to ensure there's some clock skew if the system is not in
+        // UTC
+        jwtManager.withTimezone(ZoneId.of("UTC"));
 
         // Parsing the token should NOT throw ExpiredJwtException because of clock skew
         assertDoesNotThrow(() -> jwtManager.parseToken(token));
-        
+
         Jws<Claims> parsedToken = jwtManager.parseToken(token);
         assertEquals(SUBJECT, parsedToken.getPayload().getSubject());
     }
