From d1eaba37cbfe49e1eaba183fea2581776db57a6d Mon Sep 17 00:00:00 2001
From: Trong Huu Nguyen <trong.huu.nguyen@nav.no>
Date: Fri, 13 Feb 2026 09:02:22 +0100
Subject: [PATCH] fix(naisapi/auth): set acceptable clock skew for parsing
 id_token

---
 internal/naisapi/auth/oidc.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/internal/naisapi/auth/oidc.go b/internal/naisapi/auth/oidc.go
index ce4638ce..296019eb 100644
--- a/internal/naisapi/auth/oidc.go
+++ b/internal/naisapi/auth/oidc.go
@@ -259,6 +259,7 @@ func (c *oidcClient) ParseIDToken(ctx context.Context, token string) (*IDToken,
 		jwt.WithIssuer(c.oidc.Issuer),
 		jwt.WithAudience(c.oauth2.ClientID),
 		jwt.WithClaimValue("email_verified", true),
+		jwt.WithAcceptableSkew(10*time.Second),
 		jwt.WithValidate(true),
 	)
 	if err != nil {