topic SDK: token API intermittently returns 400 Bad Request in APIs

SDK: token API intermittently returns 400 Bad Request

AndyL1 — Wed, 13 Apr 2022 17:28:29 GMT

I’m using the DuoUniversal C# SDK. Everything works fine most of the time. But intermittently, the call to Client.ExchangeAuthorizationCodeFor2faResult() throws an error because the call to the /oauth/v1/token API has returned a 400 Bad Request response code. My computer clock is accurate. What might cause it to intermittently fail like this?

Re: SDK: token API intermittently returns 400 Bad Request

AndyL1 — Thu, 14 Apr 2022 15:59:13 GMT

Some more info. I ran the client library in source (from Github) and found the HTTP 400 error response from the API has the following body:

{“error”: “invalid_client”, “error_description”: “Invalid Client assertion: Token used before nbf.”}

But as I said, my computer clock on my web server is accurate.

It looks like the client library generates a JWT to pass to the API with a nbf field set to exactly the current time on the web server. Which would mean that if the web server’s time is even a second ahead of the Duo API server’s time, the Duo API would reject the call… that can’t be right, can it?

Re: SDK: token API intermittently returns 400 Bad Request

AndyL1 — Tue, 19 Apr 2022 16:16:09 GMT

Update: was a bug in the C# client library. Apparently there will be a fixed version 1.1.1 available shortly!