Skip to content

OAuth2 Pushed Authorization Request request_uri should not be revalidated during the second authorization request after authentication #2043

Open
@said026

Description

@said026

Describe the bug
The expiration check for request_uri is performed during the second validation after user authentication, which can cause the request to fail if the process takes longer than the expires_in duration. This leads to premature expiration and failed authorization flows.

To Reproduce

  1. Initiate an OAuth2 authorization request with a short expires_in (e.g., 30 seconds)
  2. Complete user authentication, which takes longer than the expires_in duration (e.g., due to MFA or slow network)
  3. The second validation of the request_uri occurs (within OAuth2AuthorizationCodeRequestAuthenticationProvider), and the request is rejected because it appears expired

Image

Expected behavior
The expiration check during the second validation should be skipped or handled differently, so that longer authentication processes do not cause the request to expire prematurely.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions