Android and iOS

Clock skew in request verification

TLS, authorization, request integrity, caching and network failures.

Network and API protection1 min readEditorial methods

Device clocks may differ because of users or system conditions. Validate timed evidence using trusted server time and explicit tolerance.

Evaluation approach

Distinguish clock skew, expiry and network delay. Excessive tolerance enlarges the reuse window.

Application example

Offer fresh verification when a device returning from airplane mode sends stale evidence.

Limits and considerations

A client timestamp does not prove when an event occurred.

Is asking users to fix the clock enough?

Clock correction may help usability, but server trust should not depend on it. Evaluate validity against trusted time and provide a usable re-verification route.

Checks and decisions

  • Use server time
  • Document tolerance
  • Test stale evidence

Sources

The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.