fix(PAR): set additional stored PAR object properties on plain requests

panva · Jul 15, 2022 · 1be15fa · 1be15fa
1 parent 9b7867c
commit 1be15fa
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/lib/actions/authorization/pushed_authorization_request_response.js b/lib/actions/authorization/pushed_authorization_request_response.js
@@ -9,9 +9,9 @@ const MAX_TTL = 60;
 module.exports = async function pushedAuthorizationRequestResponse(ctx, next) {
   let request;
   let ttl;
+  const now = epochTime();
   if (ctx.oidc.body.request) {
     ({ request } = ctx.oidc.body);
-    const now = epochTime();
     const { payload: { exp } } = JWT.decode(request);
     ttl = exp - now;
 
@@ -21,10 +21,11 @@ module.exports = async function pushedAuthorizationRequestResponse(ctx, next) {
   } else {
     ttl = MAX_TTL;
     request = new UnsecuredJWT({ ...ctx.oidc.params })
-      .setIssuedAt()
+      .setIssuedAt(now)
       .setIssuer(ctx.oidc.client.clientId)
       .setAudience(ctx.oidc.issuer)
-      .setExpirationTime(`${MAX_TTL}s`)
+      .setExpirationTime(now + MAX_TTL)
+      .setNotBefore(now)
       .encode();
   }