Fix mysql timing bug

Gopkg.toml

@@ -75,7 +75,7 @@
 
 [[constraint]]
   name = "github.com/ory/fosite"
-  version = "0.19.2"
+  version = "0.19.4"
 
 [[constraint]]
   name = "github.com/ory/graceful"

consent/strategy_default.go

@@ -289,6 +289,13 @@ func (s *DefaultStrategy) verifyAuthentication(w http.ResponseWriter, r *http.Re
 		return nil, errors.WithStack(fosite.ErrServerError.WithDebug("The login request is marked as remember, but the subject from the login confirmation does not match the original subject from the cookie."))
 	}
 
+	authTime := session.AuthenticatedAt
+	if session.AuthenticatedAt.After(session.RequestedAt) {
+		// If we authenticated after the initial request hit the /oauth2/auth endpoint, we can update the
+		// auth time to now which will resolve issues with very short max_age times
+		authTime = time.Now().UTC()
+	}
+
 	if err := s.OpenIDConnectRequestValidator.ValidatePrompt(&fosite.AuthorizeRequest{
 		ResponseTypes: req.GetResponseTypes(),
 		RedirectURI:   req.GetRedirectURI(),
@@ -306,7 +313,7 @@ func (s *DefaultStrategy) verifyAuthentication(w http.ResponseWriter, r *http.Re
 					Subject:     session.Subject,
 					IssuedAt:    time.Now().UTC(),                // doesn't matter
 					ExpiresAt:   time.Now().Add(time.Hour).UTC(), // doesn't matter
-					AuthTime:    session.AuthenticatedAt,
+					AuthTime:    authTime,
 					RequestedAt: session.RequestedAt,
 				},
 				Headers: &jwt.Headers{},
@@ -470,6 +477,11 @@ func (s *DefaultStrategy) verifyConsent(w http.ResponseWriter, r *http.Request,
 	}
 
 	session.AuthenticatedAt = session.ConsentRequest.AuthenticatedAt
+	if session.AuthenticatedAt.After(session.ConsentRequest.RequestedAt) {
+		// If we authenticated after the initial request hit the /oauth2/auth endpoint, we can update the
+		// auth time to now which will resolve issues with very short max_age times
+		session.AuthenticatedAt = time.Now().UTC()
+	}
 
 	return session, nil
 }

oauth2/oauth2_auth_code_test.go

@@ -449,6 +449,58 @@ func TestAuthCodeWithDefaultStrategy(t *testing.T) {
 					expectIDToken:         true,
 					expectRefreshToken:    false,
 				},
+				{
+					d:       "should not cause issues if max_age is very low and consent takes a long time",
+					authURL: oauthConfig.AuthCodeURL("some-hardcoded-state") + "&max_age=3",
+					//cj:      persistentCJ,
+					lph: func(t *testing.T) func(w http.ResponseWriter, r *http.Request) {
+						return func(w http.ResponseWriter, r *http.Request) {
+							_, res, err := apiClient.GetLoginRequest(r.URL.Query().Get("login_challenge"))
+							require.NoError(t, err)
+							require.EqualValues(t, http.StatusOK, res.StatusCode)
+
+							time.Sleep(time.Second * 5)
+
+							v, res, err := apiClient.AcceptLoginRequest(r.URL.Query().Get("login_challenge"), swagger.AcceptLoginRequest{Subject: "user-a"})
+							require.NoError(t, err)
+							require.EqualValues(t, http.StatusOK, res.StatusCode)
+							require.NotEmpty(t, v.RedirectTo)
+							http.Redirect(w, r, v.RedirectTo, http.StatusFound)
+						}
+					},
+					cph: func(t *testing.T) func(w http.ResponseWriter, r *http.Request) {
+						return func(w http.ResponseWriter, r *http.Request) {
+							_, res, err := apiClient.GetConsentRequest(r.URL.Query().Get("consent_challenge"))
+							require.NoError(t, err)
+							require.EqualValues(t, http.StatusOK, res.StatusCode)
+
+							time.Sleep(time.Second * 5)
+
+							v, res, err := apiClient.AcceptConsentRequest(r.URL.Query().Get("consent_challenge"), swagger.AcceptConsentRequest{
+								GrantScope: []string{"hydra", "openid"},
+								Session: swagger.ConsentRequestSession{
+									AccessToken: map[string]interface{}{"foo": "bar"},
+									IdToken:     map[string]interface{}{"bar": "baz"},
+								},
+							})
+							require.NoError(t, err)
+							require.EqualValues(t, http.StatusOK, res.StatusCode)
+							require.NotEmpty(t, v.RedirectTo)
+							http.Redirect(w, r, v.RedirectTo, http.StatusFound)
+						}
+					},
+					cb: func(t *testing.T) httprouter.Handle {
+						return func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+							code = r.URL.Query().Get("code")
+							require.NotEmpty(t, code)
+							w.WriteHeader(http.StatusOK)
+						}
+					},
+					expectOAuthAuthError:  false,
+					expectOAuthTokenError: false,
+					expectIDToken:         true,
+					expectRefreshToken:    false,
+				},
 			} {
 				t.Run(fmt.Sprintf("case=%d/description=%s", k, tc.d), func(t *testing.T) {
 					m.Lock()