#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration')

## ClockSkewCeilingValidator Class

Refuses a configured clock skew the validator would not honour, while the host is still starting \-
and only where a profile puts a bound on it at all\.

```csharp
public sealed class ClockSkewCeilingValidator : Microsoft.Extensions.Options.IValidateOptions<Abblix.Oidc.Server.Common.Configuration.OidcOptions>
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClockSkewCeilingValidator

Implements [Microsoft\.Extensions\.Options\.IValidateOptions&lt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1')

### Remarks
FAPI 2\.0 Security Profile section 5\.3\.2\.1: a server held to it "shall reject JWTs with an
`iat` or `nbf` timestamp greater than 60 seconds in the future"\. RFC 7523 Section 3,
which governs a bearer assertion outside that profile, names no bound, so a deployment not held
to a profile may legitimately allow minutes and this guard says nothing to it\.

Where a bound does apply, the validator holds it whatever is configured \- so this guard is not
what makes the requirement true\. It exists because a setting that is silently clamped is worse
than one that is refused: a deployment could set a window, read the setting back, and believe a
number the validator was cutting down\. This says which value and which bound, at startup, where
the operator is still looking\.