Fix: 403 Forbidden Error on Windows/Docker (Clock Skew)

Description

While deploying the Day 5 (Part 5: Build and Test Locally) Healthcare App on Windows (WSL2), I encountered a persistent 403 Forbidden error when the Frontend tried to connect to the Backend API, despite all environment variables being correct.

This turned out to be a Clock Skew (Time Drift) issue between the Windows host and the Docker container running in WSL2. The Clerk token generated on Windows appeared "expired" or "from the future" to the Docker container.

The Solution

To fix this across the board for Windows users, we can adjust the Clerk configuration in api/server.py to be more tolerant of time differences.

Code Change

In api/server.py, update the ClerkConfig as follows:

# Clerk authentication setup
clerk_config = ClerkConfig(
    jwks_url=os.getenv("CLERK_JWKS_URL"),
    # 1. Disable 'issued at' check to prevent "token from future" errors
    verify_iat=False,
    # 2. Add leeway (tolerance window) to account for clock drift
    # 30.0 seconds is safe for local/dev environments
    leeway=30.0,
)
clerk_guard = ClerkHTTPBearer(clerk_config)

Important Note / Security Implication

The leeway parameter is a trade-off between Convenience and Security.

• For Development/Learning: Setting leeway=30.0 is safe and recommended to prevent WSL2 clock sync issues from blocking your progress.

• For Production: In a real production environment (like AWS), servers are usually synchronized. You should keep leeway minimal (e.g., 5-10s) to prevent Replay Attacks, or use logic to apply this setting only in development mode.

After applying this change, you must rebuild your Docker image