fix(auth): tolerate device clock skew in login timestamp check#113
Merged
Conversation
The `verify_login_hash` check required the client timestamp to exactly equal the server's stored challenge timestamp. The Supernote device sends its own local epoch time in the login request, so any clock drift (e.g. from disabling NTP and manually setting a timezone) caused a silent auth failure that the device surfaced as "System time is incorrect". Replace the exact equality check with a tolerance window matching the challenge TTL (5 minutes). The random_code nonce + TTL already provides replay protection, so strict equality was over-constraining. Also promote all verify_login_hash failure paths from silent returns to logger.warning with enough context (skew diff in ms, stored vs client timestamps) to diagnose auth failures without needing to reproduce them. Claude-Session: https://claude.ai/code/session_01UgzvCBzPZ9Yvv8nANjtYv3
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Covers all new code paths introduced in the timestamp skew fix: exact timestamp match, small skew within tolerance, skew exceeding the TTL window, non-numeric timestamp, missing challenge, wrong hash, and unknown user. Claude-Session: https://claude.ai/code/session_01UgzvCBzPZ9Yvv8nANjtYv3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
verify_login_hashwith a 5-minute tolerance window matching the challenge TTLrandom_codenonce + TTL already provides full replay protection, so strict equality was unnecessarily fragileverify_login_hashfailure paths from silentreturn Falsetologger.warningwith specific context (skew diff in ms, stored vs client timestamps) to make future auth failures diagnosable from logsTest plan
160 passed)test_web_parity.py(819 passed)https://claude.ai/code/session_01UgzvCBzPZ9Yvv8nANjtYv3