ConsentRequest should use time.Now().UTC() for ExpiresAt.

[dimitertodorov]

My consent requests appear to be expiring in the past.
The compare is happening here:

hydra/oauth2/consent_strategy.go

Lines 59 to 61 in df8e6eb

	if time.Now().After(consent.ExpiresAt) {
	return nil, errors.Errorf("Token expired")
	}

I added some verbosity, and it looks like we are comparing times from different time zones.
Token expired 2017-12-04 17:01:25.2171648 -0500 EST m=+6.980766101 - 2017-12-04 17:11:22.363517 +0000 +0000"
Changing the following line to use UTC for ExpiresAt seems to fix the issue.
Before:

hydra/oauth2/consent_strategy.go

Line 114 in df8e6eb

ExpiresAt: time.Now().Add(s.DefaultChallengeLifespan),

after:

		ExpiresAt:        time.Now().UTC().Add(s.DefaultChallengeLifespan),

[aeneasr]

Does the JSON DateTime format not include time zones? I'd have to check what the convention is there, but if it's UTC then nice find! :)

[aeneasr]

Hm, the timezone should be appended, see: https://en.wikipedia.org/wiki/ISO_8601#Time_offsets_from_UTC

Any idea why that isn't happening?

[aeneasr]

So I checked this myself and it seems like UTC() should not be necessary:

package main

import (
	"encoding/json"
	"fmt"
	"time"
)

type TT struct {
	T time.Time
}

func main() {
	t, _ := time.Now().Zone()
	fmt.Printf("%s\n", t)

	out, _ := json.Marshal(&TT{T: time.Now()})
	fmt.Printf("%s\n", out)

	var tt TT
	_ = json.Unmarshal(out, &tt)
	fmt.Printf("%s", tt.T.Format(time.RFC3339))

	out, _ = json.Marshal(&TT{T: time.Now().UTC()})
	fmt.Printf("%s\n", out)

	_ = json.Unmarshal(out, &tt)
	fmt.Printf("%s", tt.T.Format(time.RFC3339))

	out, _ = json.Marshal(&TT{T: time.Now().Add(time.Hour)})
	fmt.Printf("%s\n", out)

	_ = json.Unmarshal(out, &tt)
	fmt.Printf("%s", tt.T.Format(time.RFC3339))
}

Output:

CET

{"T":"2017-12-07T22:30:59.6512843+01:00"}
2017-12-07T22:30:59+01:00

{"T":"2017-12-07T21:30:59.6517876Z"}
2017-12-07T21:30:59Z

{"T":"2017-12-07T23:30:59.652284+01:00"}
2017-12-07T23:30:59+01:00

As you can see, there does not seem to be any data loss when marshalling/unmarshalling.

Which database are you using? Maybe there's something funny going on there.

[dimitertodorov]

Did you actually fix consent_strategy.go?

That is the one that was giving me trouble.
Still not fixed on Master.

[aeneasr]

Looks like that one slipped through