diff --git a/google/auth/_helpers.py b/google/auth/_helpers.py index 09f32f84e..11c6b1adb 100644 --- a/google/auth/_helpers.py +++ b/google/auth/_helpers.py @@ -20,7 +20,7 @@ import urllib -CLOCK_SKEW_SECS = 10 # 10 seconds +CLOCK_SKEW_SECS = 60 # 60 seconds CLOCK_SKEW = datetime.timedelta(seconds=CLOCK_SKEW_SECS) diff --git a/google/auth/jwt.py b/google/auth/jwt.py index d931bf7b9..1bc7e5e71 100644 --- a/google/auth/jwt.py +++ b/google/auth/jwt.py @@ -190,7 +190,11 @@ def _verify_iat_and_exp(payload): # for clock skew. earliest = iat - _helpers.CLOCK_SKEW_SECS if now < earliest: - raise ValueError("Token used too early, {} < {}".format(now, iat)) + raise ValueError( + "Token used too early, {} < {}. Check that your computer's clock is set correctly.".format( + now, iat + ) + ) # Make sure the token wasn't issued in the past. exp = payload["exp"]