Why ASP.NET Core Accepts Recently Expired JWTs and How to Disable It

·2 views

ASP.NET Core accepts JSON Web Tokens for up to five minutes after their expiration timestamp by default, which can surprise developers who expect strict cutoffs. The behavior is an intentional clock skew allowance permitted by the JWT specification (RFC 7519) to tolerate small time differences between servers. Other frameworks such as Node.js, Go, and Python default to zero leeway, while Spring Security allows a 60-second buffer. This mismatch can cause inconsistent token validation across polyglot microservice setups. Developers can enforce strict expiration by setting ClockSkew to TimeSpan.Zero in the JWT bearer configuration.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Hosting a three-repo security platform on free tiers: the bugs that surfaced

A developer built Sentinel, a self-hostable security monitoring platform split into an API, a dashboard, and a Python scanner, and documented the problems that emerged when moving it from local Docker Compose to free hosting services. Storing the refresh token in a SameSite=Strict cookie caused logouts on every reload across different hosted domains, and the developer avoided the tempting SameSite=None fix by routing requests through a same-origin proxy in the dashboard. A sign-in error was then traced to a relative-URL bug in the proxy mode that made every API call throw before being sent. The account also covers how a seed script's upsert design prevented admin password resets, leading to a one-off reset script.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Ionify Explores Virtual Compiler Inputs to Avoid Full Tailwind Rescans

Ionify, an open-source frontend build tool, previously faced a Tailwind performance regression in which changing classes triggered a full rescan, raising build times from about 300ms to 1.3s in one workload. A first optimization cut the overhead by roughly 40 to 50 percent, prompting the developer to ask whether the unnecessary rescan could be eliminated entirely. Ionify's AI coding assistant advised a conservative approach, since changes can affect other inputs through dependencies, so scanning only the modified file is not automatically correct. The developer instead explored building a Virtual Input from the artifacts Tailwind's compiler needs, invalidating it only when correctness-relevant dependencies change. The work remains conceptual, with no guarantee that unrelated dependency changes can always be ignored.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tesla's Low-Advertising Growth Model Relies on Product Buzz and Brand Advocacy

Tesla has built strong brand awareness and sales with comparatively little traditional advertising, relying instead on its vehicles, launch events, distinctive design, and direct-sales model. The article argues this is not proof that advertising is unnecessary, but shows how product interest, customer advocacy, and earned media can drive demand. Tesla's 2025 annual report states it has historically sold vehicles at relatively low marketing cost while still monitoring its public narrative and investing in customer education and advertising when needed. The piece contends that products generating genuine conversation give customers and media material to spread the message themselves. It adds that this model only works when the product delivers real value, since hype without substance can damage long-term trust.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer details test suite for a high-concurrency Spring Boot e-commerce backend

A developer documented the testing and quality engineering approach used in ShopEase, a Spring Boot 3.x e-commerce backend built on Java 17. The strategy spans unit and slice tests for controllers and services, integration tests for cross-component database flows, and concurrency tests that simulate multi-threaded contention to prevent inventory overselling. Load and stress tests run through a custom Java concurrency harness to measure throughput and failure rates under heavy traffic. The author reports that the suite achieved a 100% build success rate across modules and thread-safe inventory handling.

0 comments Read more at DEV Community