API V8 Token Expiration DateTime isn't stored in UTC #4603

New issue

Open

opened 2026-02-20 16:20:26 -05:00 by deekerman · 3 comments

deekerman commented

2026-02-20 16:20:26 -05:00

Owner

Originally created by @deuks on GitHub (Aug 23, 2021).

When creating an Access or Refresh Token using API V8, the expiration datetime isn't stored in UTC in the database.

Instead, the time zone it is stored in is based on the server's php.ini time zone. While I haven't experienced any issues regarding authentication, it does mean it appears wrong in the view.

Possible Fix

This is easily fixable by changing 1 singular line of code in 2 different files:

github.com/salesagility/SuiteCRM@f463031bee/Api/V8/OAuth2/Repository/AccessTokenRepository.php (L83)

github.com/salesagility/SuiteCRM@f463031bee/Api/V8/OAuth2/Repository/RefreshTokenRepository.php (L50)

Either of these format() functions needs to be changed to a getTimestamp(). We can then use gmdate() to properly format the token expiration datetime into UTC Y-m-d H:i:s. I have tested this and it fixed the issue. I can issue a pull request, but I haven't done one before so it will take some time.

To Reproduce:

Set php.ini timezone to anything but GMT/UTC.
Use API V8 to generate access or refresh token
Check Database to see stored datetime of token expiration

Originally created by @deuks on GitHub (Aug 23, 2021). When creating an Access or Refresh Token using API V8, the expiration datetime isn't stored in UTC in the database. Instead, the time zone it is stored in is based on the server's php.ini time zone. While I haven't experienced any issues regarding authentication, it does mean it appears wrong in the view. ![Access-Token-Expiration-Example](https://user-images.githubusercontent.com/49660052/130482062-8dcf0ad5-09f2-4e91-ad9c-fcb7077942c8.png) #### Possible Fix This is easily fixable by changing 1 singular line of code in 2 different files: https://github.com/salesagility/SuiteCRM/blob/f463031bee59676d7d5be53bb32d551cd70a5648/Api/V8/OAuth2/Repository/AccessTokenRepository.php#L83 https://github.com/salesagility/SuiteCRM/blob/f463031bee59676d7d5be53bb32d551cd70a5648/Api/V8/OAuth2/Repository/RefreshTokenRepository.php#L50 Either of these format() functions needs to be changed to a getTimestamp(). We can then use gmdate() to properly format the token expiration datetime into UTC Y-m-d H:i:s. I have tested this and it fixed the issue. I can issue a pull request, but I haven't done one before so it will take some time. To Reproduce: 1. Set php.ini timezone to anything but GMT/UTC. 2. Use API V8 to generate access or refresh token 3. Check Database to see stored datetime of token expiration

deekerman added the

labels

2026-02-20 16:20:26 -05:00

deekerman commented

2026-02-20 16:20:27 -05:00

Author

Owner

@tsmgeek commented on GitHub (Aug 25, 2021):

https://github.com/bshaffer/oauth2-server-php/issues/570

As its a \DateTime object you should be able to do the following. Note that this changes the timezone of the DateTime object itself.
$accessTokenEntity->getExpiryDateTime()->setTimezone(new DateTimeZone('UTC'))->format('Y-m-d H:i:s')

@tsmgeek commented on GitHub (Aug 25, 2021): https://github.com/bshaffer/oauth2-server-php/issues/570 As its a \DateTime object you should be able to do the following. Note that this changes the timezone of the DateTime object itself. `$accessTokenEntity->getExpiryDateTime()->setTimezone(new DateTimeZone('UTC'))->format('Y-m-d H:i:s')`

deekerman commented

2026-02-20 16:20:27 -05:00

Author

Owner

@deuks commented on GitHub (Aug 25, 2021):

Yeah that's works just as well. Might switch my fix to that, keeping everything within the DateTime object makes more sense than converting to a timestamp just to use gmdate. Thanks!

@deuks commented on GitHub (Aug 25, 2021): Yeah that's works just as well. Might switch my fix to that, keeping everything within the DateTime object makes more sense than converting to a timestamp just to use gmdate. Thanks!

deekerman commented

2026-02-20 16:20:29 -05:00

Author

Owner

@J-Wick4 commented on GitHub (Nov 11, 2023):

I solved this problem by changing the PHP time server value to UTC in php.ini. In personal preferences in SuiteCRM, you can set your timezone.

date.timezone = "UTC"

This method is upgrade safe.

@J-Wick4 commented on GitHub (Nov 11, 2023): I solved this problem by changing the PHP time server value to UTC in php.ini. In personal preferences in SuiteCRM, you can set your timezone. `date.timezone = "UTC"` This method is upgrade safe.