{"record":{"id":"63f037e95c13604c","repo":"cloudflare/cloudflared","slug":"metadata-jwt-is-more-than-s-in-the-future","errorCode":null,"errorMessage":"metadata JWT is more than %s in the future","messagePattern":"metadata JWT is more than (.+?) in the future","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"token/token.go","lineNumber":516,"sourceCode":"\t_ = resp.Body.Close()\n\n\trawJWT := resp.Header.Get(accessMetadataRespHeader)\n\tif rawJWT == \"\" {\n\t\treturn \"\", fmt.Errorf(\"failed to find Access application at %s\", reqURL)\n\t}\n\treturn rawJWT, nil\n}\n\nfunc validateMetadataIssuedAt(iat int64, now time.Time) error {\n\tif iat <= 0 {\n\t\treturn errors.New(\"metadata JWT iat is missing or invalid\")\n\t}\n\tissuedAt := time.Unix(iat, 0)\n\tif issuedAt.Before(now.Add(-metadataMaxAge)) {\n\t\treturn fmt.Errorf(\"metadata JWT is older than %s\", metadataMaxAge)\n\t}\n\tif issuedAt.After(now.Add(metadataAllowedClockSkew)) {\n\t\treturn fmt.Errorf(\"metadata JWT is more than %s in the future\", metadataAllowedClockSkew)\n\t}\n\treturn nil\n}\n\nfunc handleRedirects(req *http.Request, via []*http.Request, orgToken string) error {\n\t// attach org token to login request\n\tif strings.Contains(req.URL.Path, AccessLoginWorkerPath) {\n\t\treq.AddCookie(&http.Cookie{Name: tokenCookie, Value: orgToken}) //nolint: gosec\n\t}\n\n\t// attach app session cookie to authorized request\n\tif strings.Contains(req.URL.Path, AccessAuthorizedWorkerPath) {\n\t\t// We need to check and see if the CF_APP_SESSION cookie was set\n\t\tfor _, prevReq := range via {\n\t\t\tif prevReq != nil && prevReq.Response != nil {\n\t\t\t\tfor _, c := range prevReq.Response.Cookies() {\n\t\t\t\t\tif c.Name == appSessionCookie {\n\t\t\t\t\t\treq.AddCookie(&http.Cookie{Name: appSessionCookie, Value: c.Value}) //nolint: gosec","sourceCodeStart":498,"sourceCodeEnd":534,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/token/token.go#L498-L534","documentation":"validateMetadataIssuedAt also rejects JWTs whose `iat` is in the future by more than metadataAllowedClockSkew. A metadata token claiming to be issued significantly after the current time is treated as invalid, protecting against tokens minted with bad clocks or forged timestamps.","triggerScenarios":"GetAppInfo parses a metadata JWT whose `iat` exceeds now + metadataAllowedClockSkew. Typically caused by the local machine's clock running behind real time (slow clock) while the edge issued the token with the correct current timestamp.","commonSituations":"Laptop/desktop with drifting RTC or paused VM whose clock fell behind; container with wrong timezone/clock after host suspend; NTP not running so local time lags the Cloudflare edge by minutes or hours.","solutions":["Synchronize the local clock with NTP (chronyd/systemd-timesyncd, `w32tm /resync` on Windows).","For VMs/containers, enable the hypervisor/host clock-sync feature and resume-pause clock catch-up.","Re-run the command after the clock is correct; the token itself is fine.","Verify no test/mocked time source (e.g. faketime, frozen CLOCK_REALTIME) is in effect for the process."],"exampleFix":"// before\n$ cloudflared access login https://myteam.cloudflareaccess.com\n// error: metadata JWT is more than 5m0s in the future\n// after — fix local clock, then retry\n$ sudo timedatectl set-ntp true && sudo chronyc makestep\n$ cloudflared access login https://myteam.cloudflareaccess.com","handlingStrategy":"validation","validationCode":"// detect a lagging local clock before calling GetAppInfo\nresp, err := http.Head(\"https://www.cloudflare.com\")\nif err == nil {\n    serverDate, _ := http.ParseTime(resp.Header.Get(\"Date\"))\n    if skew := time.Since(serverDate); skew < -time.Minute {\n        return fmt.Errorf(\"local clock is %s behind server time; enable NTP\", -skew)\n    }\n}","typeGuard":null,"tryCatchPattern":"appInfo, err := token.GetAppInfo(authDomain, appURL)\nif err != nil {\n    if strings.Contains(err.Error(), \"in the future\") {\n        return fmt.Errorf(\"%w — local clock is behind; resynchronize with NTP and retry\", err)\n    }\n    return err\n}","preventionTips":["Enable NTP/systemd-timesyncd on all machines running cloudflared.","Enable clock sync for paused/resumed VMs and WSL instances.","Avoid faketime or frozen-clock wrappers around cloudflared processes.","Alert on host clock drift larger than a minute."],"tags":["jwt","clock-skew","time","cloudflare-access"],"backgroundTag":"jwt-token-expired","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}