From 607dd2724b39a8d37f69c49ea1a507baa38fe0fa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gr=C3=A9goire=20Pailler?= Date: Fri, 13 Mar 2026 12:31:41 +0700 Subject: [PATCH 1/3] Reduce default JWT expiry from 10 to 5 minutes GitHub rejects JWTs with an 'exp' claim more than 10 minutes in the future. With a 10-minute default, even a few seconds of clock drift on the client machine causes intermittent 401 errors. Reducing to 5 minutes provides a comfortable buffer while still being long enough for any practical use. --- internal/generate.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/generate.go b/internal/generate.go index a295572..78eb8e4 100644 --- a/internal/generate.go +++ b/internal/generate.go @@ -39,7 +39,7 @@ func Generate(c *cli.Context) error { } if jwtExpiry < 1 || jwtExpiry > 10 { - jwtExpiry = 10 + jwtExpiry = 5 } var err error From 85d521b50ed0272a38de6508fd6ad9828b554bf3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gr=C3=A9goire=20Pailler?= Date: Fri, 13 Mar 2026 12:31:59 +0700 Subject: [PATCH 2/3] Fix --duration flag being ignored The code read "jwt-expiry" but the flag is registered as "duration", so the value was always 0 and then default 10 was used. Also update the flag description to reflect the new default of 5 minutes and remove the part about "useful when using --jwt" because the duration applies to all JWT generation. --- internal/generate.go | 2 +- internal/generate_flags.go | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/internal/generate.go b/internal/generate.go index 78eb8e4..6e546bd 100644 --- a/internal/generate.go +++ b/internal/generate.go @@ -20,7 +20,7 @@ func Generate(c *cli.Context) error { keyPath := c.String("key") keyBase64 := c.String("base64-key") printJWT := c.Bool("jwt") - jwtExpiry := c.Int("jwt-expiry") + jwtExpiry := c.Int("duration") hostname := strings.ToLower(c.String("hostname")) tokenOnly := c.Bool("token-only") silent := c.Bool("silent") diff --git a/internal/generate_flags.go b/internal/generate_flags.go index e2c09b4..3e6f382 100644 --- a/internal/generate_flags.go +++ b/internal/generate_flags.go @@ -51,10 +51,10 @@ func GenerateFlags() []cli.Flag { }, &cli.IntFlag{ Name: "duration", - Usage: "The expiry time of the JWT in minutes up to a maximum value of 10, useful when using the --jwt flag", + Usage: "The expiry time of the JWT in minutes, from 1 to 10 (default: 5). Lower values are safer against clock drift", Required: false, Aliases: []string{"d"}, - Value: 1, + Value: 5, }, &cli.BoolFlag{ Name: "silent", From f136c733c609d531108a276b153d7e68178dbcc1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gr=C3=A9goire=20Pailler?= Date: Mon, 23 Mar 2026 07:09:50 +0700 Subject: [PATCH 3/3] Revert "Reduce default JWT expiry from 10 to 5 minutes" and revert usage update for "duration" flag. --- internal/generate.go | 2 +- internal/generate_flags.go | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/internal/generate.go b/internal/generate.go index 6e546bd..19f7c82 100644 --- a/internal/generate.go +++ b/internal/generate.go @@ -39,7 +39,7 @@ func Generate(c *cli.Context) error { } if jwtExpiry < 1 || jwtExpiry > 10 { - jwtExpiry = 5 + jwtExpiry = 10 } var err error diff --git a/internal/generate_flags.go b/internal/generate_flags.go index 3e6f382..e2c09b4 100644 --- a/internal/generate_flags.go +++ b/internal/generate_flags.go @@ -51,10 +51,10 @@ func GenerateFlags() []cli.Flag { }, &cli.IntFlag{ Name: "duration", - Usage: "The expiry time of the JWT in minutes, from 1 to 10 (default: 5). Lower values are safer against clock drift", + Usage: "The expiry time of the JWT in minutes up to a maximum value of 10, useful when using the --jwt flag", Required: false, Aliases: []string{"d"}, - Value: 5, + Value: 1, }, &cli.BoolFlag{ Name: "silent",