Open
Description
Describe the bug
The expiration check for request_uri
is performed during the second validation after user authentication, which can cause the request to fail if the process takes longer than the expires_in
duration. This leads to premature expiration and failed authorization flows.
To Reproduce
- Initiate an OAuth2 authorization request with a short
expires_in
(e.g., 30 seconds) - Complete user authentication, which takes longer than the
expires_in
duration (e.g., due to MFA or slow network) - The second validation of the
request_uri
occurs (withinOAuth2AuthorizationCodeRequestAuthenticationProvider
), and the request is rejected because it appears expired
Expected behavior
The expiration check during the second validation should be skipped or handled differently, so that longer authentication processes do not cause the request to expire prematurely.