From 4dd6cf42748f83955b5d72a2f06aba30668bc247 Mon Sep 17 00:00:00 2001
From: greiser <sabine.greiser@integral-learning.de>
Date: Mon, 27 Jul 2026 09:03:16 +0200
Subject: [PATCH 1/2] Align SSO token verification window with other LMS
 plugins

Tighten the token verification window from 1h to 60s, matching the
value used by the equivalent auth plugin implementation for other
LMS platforms. Token length already matched (30 characters).
---
 services/SSOService.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/SSOService.php b/services/SSOService.php
index c5e252e..3fa1d55 100644
--- a/services/SSOService.php
+++ b/services/SSOService.php
@@ -82,7 +82,7 @@ public static function verifyToken($token, $hashedId)
 
         if (!is_null($mumieToken) && $mumieToken->token == $token && $userRecord != null) {
             $current = time();
-            if (($current - $mumieToken->timecreated) >= (60*60)) {
+            if (($current - $mumieToken->timecreated) >= 60) {
                 $response->status = "invalid";
             } else {
                 $response->status = "valid";

From 8ea42176286a7e75a3bd25a70b0ce93820085620 Mon Sep 17 00:00:00 2001
From: greiser <sabine.greiser@integral-learning.de>
Date: Mon, 27 Jul 2026 10:05:26 +0200
Subject: [PATCH 2/2] Add changelog entry for SSO token verification window fix

---
 changelog.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/changelog.md b/changelog.md
index 5b419e9..fa888c0 100644
--- a/changelog.md
+++ b/changelog.md
@@ -2,6 +2,10 @@
 
 All important changes to this plugin will be documented in this file.
 
+## TODO
+### Changed
+- Tightened the SSO token verification window from 1 hour to 60 seconds, matching the other LMS plugin implementations
+
 ## [v1.5] - 2021-10-22
 ### Added
 - Ungraded MUMIE Tasks are now supported in Stud.IP. They represent ungraded links to MUMIE articles.