tree 96ee70346873bb85b7357457f527057c4b52693d
parent 5112b45ce2eae2ed253adeacb8887d42f429e27b
author Adam Langley <alangley@gmail.com> 1644860445 -0800
committer Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> 1644864035 +0000

acvp: don't send the Authorization header when renewing tokens

ACVP authorisation tokens expire and, once expired, need to be renewed
by sending a new TOTP code. We almost never hit this but some FIPS
modules are slow enough that they can't compute the response within the
token lifetime.

But the ACVP code was putting an Authorization header on the renewal
message because it put that header on every message. But doing so breaks
the renewal because the server rejects the request because the token has
expired before noticing that it's a renewal request.

Also, put a 10 second buffer on deciding if a token has expired to
account for the transmission delay.

Change-Id: I50643a223cdb313d07dd7b2c559ad160cbe608ff
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/51385
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Adam Langley <agl@google.com>