Shouldn't time skew be subtracted in isTokenExpired?

Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

token-exchange

Describe the bug

Timeskew is a non negative value and is the difference between the server and the client in seconds. Then it should be subtracted not added like in your isTokenExpired code here:

kc.isTokenExpired = function(minValidity) {
        if (!kc.tokenParsed || (!kc.refreshToken && kc.flow != 'implicit' )) {
            throw 'Not authenticated';
        }

        if (kc.timeSkew == null) {
            logInfo('[KEYCLOAK] Unable to determine if token is expired as timeskew is not set');
            return true;
        }

        var expiresIn = kc.tokenParsed['exp'] - Math.ceil(new Date().getTime() / 1000) + kc.timeSkew;
        if (minValidity) {
            if (isNaN(minValidity)) {
                throw 'Invalid minValidity';
            }
            expiresIn -= minValidity;
        }
        return expiresIn < 0;
    }

https://github.com/keycloak/keycloak/blob/67b6cf7eac986f8247f77b0a51c66a1fc4151a38/js/libs/keycloak-js/src/keycloak.js#L617C13-L617C23

Version

19.0.3

Regression

• The issue is a regression

Expected behavior

isTokenExpired should be truthfull

Actual behavior

isTokenExpired sometimes give me false instead of true

How to Reproduce?

Set tokenExpiration to 1 minute in keycloak admin, let the time skew be around 46 seconds, then login to your web app with keycloak-js. Close the computer for a minute. Then open it and you'll get 401 unauthorized requests on your non-keycloak server requests.

Anything else?

No response