Client time versus server time
Client display time, monotonic duration measurement, application-server time, an external HTTP receipt, clock synchronization, and signed datum timestamping are different jobs. Choose the mechanism from the requirement; SpyderGoat fits only the external HTTP receipt role.
Choose by job
The recommendation column is deliberately not product-first. Five of these six mechanisms are not SpyderGoat, and each has a distinct job.
| Mechanism | Recommended mechanism | Best for | Required limitation | SpyderGoat fit |
|---|---|---|---|---|
| Client wall clock | Client wall clock | Local date and time display with an explicit timezone | User or device controlled; can be adjusted or jump | No; optional comparison only |
| Monotonic clock | Monotonic clock | Elapsed duration and timeout measurement inside one runtime | No civil UTC timestamp | No |
| Application server clock/log | Application server clock/log | Application receipt timestamps and operational logs | Same clock and trust domain; not external event proof | Usually no |
| SpyderGoat HTTP receipt | SpyderGoat HTTP receipt | Lightweight external clock comparison | Latency, unsigned, no accuracy SLA, and no synchronization | Yes, only for this bounded role |
| NTP | NTP | Clock synchronization and discipline | Separate protocol, deployment, configuration, and security assumptions | No |
| RFC 3161 timestamp token | RFC 3161 timestamp token | Signed datum timestamping that binds a digest to a TSA assertion | TSA trust, certificate, policy, validation, and event-semantic limits | No |
Decision examples
- Local display: use the client wall clock and timezone when local presentation is the requirement; an HTTP dependency is unnecessary solely to format a clock.
- Elapsed duration: use a monotonic clock such as performance.now() rather than subtracting wall-clock receipts.
- Application receipt: store when your own application accepted the request and label it application_received_at.
- External clock comparison: fetch /mjd, retain request timing, and report estimated disagreement with RTT.
- Signed datum timestamping: use an RFC 3161-capable TSA workflow when a signed token binding a submitted digest to asserted time is required.
RFC 3161 is not real-world event proof
RFC 3161 describes a time-stamping service in which a Time-Stamp Authority issues a signed token concerning a submitted datum or digest under the TSA, certificate, policy, and validation assumptions.
An RFC 3161 token can provide evidence about that datum and asserted time under those assumptions. RFC 3161 does not by itself prove that the real-world event described by the data occurred.
Where the HTTP receipt fits
SpyderGoat samples Date.now() while the Worker constructs a response and returns one server-derived observation as UTC, Unix seconds, and MJD. The source value "server" is only a literal marker.
It is not a signature, origin or authentication statement, clock discipline, monotonic timer, RFC 3161 token, or event proof. Network latency and asymmetry remain part of cross-system comparison.
Examples
Try the bounded HTTP mechanism
curl --fail-with-body --max-time 5 https://spydergoat.com/mjdLimits and non-guarantees
- What this receipt does not guarantee: SpyderGoat returns a server-derived HTTP time receipt derived from the Cloudflare Worker runtime clock. The Worker clock is read during response construction. It is an unsigned HTTP receipt, not NTP, an atomic-clock feed, a signed timestamp, or an RFC 3161 authority or timestamp token. It does not synchronize or discipline your clock, and it does not prove when an external event occurred. Displayed precision is not an accuracy guarantee. HTTP and network latency affect comparisons. SpyderGoat publishes no uptime or accuracy SLA.
- Choose a mechanism by its actual trust domain and requirement; no one mechanism wins every time-related scenario.
Runtime provenance
The SpyderGoat row is grounded in current Worker code and tests. The primary sources below support only the stated roles of monotonic timing, NTP clock synchronization, and RFC 3161 datum timestamping.