The documentation for the Oauth2 Resource Server validation (https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#oauth2resourceserver-validation) contain a remark that the default configuration of 30 seconds clock is configured.
Two remarks on this:
- The current implemented default seems to 60 seconds JwtTimestampValidator
Either the documenation or the code need be changed.
- When using the spring boot starter, a configuration property to change the default might make sense.