fix(auth-ui): require fresh auth to satisfy prompt=login via sessionId hand-back

resolveOidc's /authorize sessionId hand-back finalizes the callback for a query-supplied sessionId before decideAuthorize runs. For prompt=login that let a forged &sessionId=<stale-but-live session> skip the forced re-authentication the AS demanded.

Gate it: a handed-back session satisfies prompt=login only if a primary factor (password/passkey/idpIntent) was verified within FRESH_LOGIN_WINDOW_MS (2 min); otherwise fall through to decideAuthorize -> /login. select_account is unaffected (selecting your own live session is safe). healIfSessionDead now returns the live session so the gate can read factor verifiedAt; nowMs is injected (default Date.now()) for deterministic tests.

Author: yahyafakhroji

app/resources/authorize/__tests__/oidc-handback.test.ts

@@ -14,14 +14,20 @@
 // a prompt=select_account / prompt=login request bounced straight back to /accounts (or /login)
 // — forcing the user to pick the account they had just authenticated with. This test pins the
 // finalize-don't-bounce behavior at the resolveOidc layer.
-import { FakeAuthProvider } from '@/modules/auth/providers/fake/fake-provider';
+import { FakeAuthProvider, FIXED_NOW } from '@/modules/auth/providers/fake/fake-provider';
 import { sessionsCookie } from '@/modules/auth/session/cookie';
-import type { AuthRequest } from '@/modules/auth/types';
+import type { AuthRequest, Session } from '@/modules/auth/types';
 import { resolveAuthorize, outcomeToResponse } from '@/resources/authorize';
 import { describe, it, expect } from 'vitest';
 
 const SESSION = { id: 'sess-live-1', token: 'tok-live-1' };
 
+// seedLiveSession stamps factors at FIXED_NOW. Pin the loader's nowMs to FIXED_NOW so a seeded
+// session reads as freshly authenticated for the prompt=login freshness gate — keeping these
+// regression-lock cases deterministic instead of depending on wall-clock Date.now() (the fake's
+// own MERGE-RULE warns finite windows against FIXED_NOW rot into time bombs).
+const SEEDED_NOW_MS = Date.parse(FIXED_NOW);
+
 /** Build a signed sessions cookie carrying a single live session entry. */
 async function mintSessionsCookie() {
   return sessionsCookie.serialize([
@@ -53,7 +59,8 @@ async function run(provider: FakeAuthProvider, cookie: string, search: string):
   const request = new Request(`http://localhost/id/authorize${search}`, {
     headers: { cookie: cookie.split(';')[0] },
   });
-  const outcome = await resolveAuthorize(provider, request);
+  // Pin nowMs to the fixture clock so seedLiveSession factors are fresh (see SEEDED_NOW_MS).
+  const outcome = await resolveAuthorize(provider, request, SEEDED_NOW_MS);
   return outcomeToResponse(outcome, new URL(request.url));
 }
 
@@ -97,3 +104,123 @@ describe('resolveOidc — explicit sessionId hand-back finalizes the callback (r
     expect(res.headers.get('location') ?? '').toContain('/accounts');
   });
 });
+
+// ─────────────────────────────────────────────────────────────────────────────────
+// SECURITY REGRESSION LOCK: prompt=login freshness gate against forged sessionId hand-back.
+//
+// `?requestId=oidc_<id>&sessionId=<live>` lets ANY caller hand back a live cookie session id.
+// For prompt=login the Authorization Server explicitly demanded FRESH re-authentication this
+// ceremony — so a stale-but-live session id appended to the URL MUST NOT finalize the callback;
+// it must fall through to decideAuthorize, which routes prompt=login → /login (forced re-auth).
+// select_account is harmless (you may pick your own live session), so the gate is scoped to
+// prompt=login only.
+// ─────────────────────────────────────────────────────────────────────────────────
+
+const NOW_MS = Date.parse('2026-06-24T12:00:00.000Z');
+const TEN_MIN_MS = 10 * 60 * 1000;
+const FIVE_SEC_MS = 5 * 1000;
+
+/**
+ * A FakeAuthProvider whose getSession returns a session with a CONTROLLABLE
+ * `factors.password.verifiedAt`. The shared fake hardcodes verifiedAt to FIXED_NOW, so it
+ * cannot express a "stale relative to nowMs" factor — this inline stub fills that gap while
+ * delegating createCallback/getAuthRequest to the real fake behaviour.
+ */
+class FreshnessProvider extends FakeAuthProvider {
+  constructor(
+    prompt: AuthRequest['prompt'],
+    private readonly verifiedAtMs: number
+  ) {
+    super({ authRequests: { req1: { id: 'req1', clientId: 'client1', scopes: [], prompt } } });
+  }
+
+  override async getSession(id: string, _token: string): Promise<Session | null> {
+    if (id !== SESSION.id) return null;
+    return {
+      id: SESSION.id,
+      token: SESSION.token,
+      factors: { password: { verifiedAt: new Date(this.verifiedAtMs) } },
+      expiresAt: '2099-01-01T00:00:00.000Z',
+      changedAt: '2026-01-01T00:00:00.000Z',
+    };
+  }
+}
+
+/** Drive resolveAuthorize with an injected nowMs (the route default is Date.now()). */
+async function runAt(
+  provider: FakeAuthProvider,
+  cookie: string,
+  search: string,
+  nowMs: number
+): Promise<Response> {
+  const request = new Request(`http://localhost/id/authorize${search}`, {
+    headers: { cookie: cookie.split(';')[0] },
+  });
+  const outcome = await resolveAuthorize(provider, request, nowMs);
+  return outcomeToResponse(outcome, new URL(request.url));
+}
+
+describe('resolveOidc — prompt=login freshness gate (anti-forgery hardening)', () => {
+  it('prompt=login + STALE handed-back session → does NOT finalize; routes to /login (re-auth)', async () => {
+    // The security regression lock: a stale (10-min-old) live session forged onto a prompt=login
+    // URL must NOT skip the forced re-authentication the AS asked for.
+    const provider = new FreshnessProvider(['login'], NOW_MS - TEN_MIN_MS);
+    const cookie = await mintSessionsCookie();
+
+    const res = await runAt(
+      provider,
+      cookie,
+      `?requestId=oidc_req1&sessionId=${SESSION.id}`,
+      NOW_MS
+    );
+
+    expect(res.status).toBe(302);
+    const loc = res.headers.get('location') ?? '';
+    // Did NOT finalize the callback — no client redirect / ?code=.
+    expect(loc).not.toContain('client.acme.test/callback');
+    expect(loc).not.toContain('code=');
+    // Routed to forced re-auth, carrying the requestId so the ceremony resumes.
+    expect(loc).toContain('/login');
+    expect(loc).toContain('requestId=oidc_req1');
+  });
+
+  it('prompt=login + FRESH handed-back session → finalizes the callback (legitimate login)', async () => {
+    // A genuinely fresh (5-sec-old) session satisfies prompt=login — the normal post-auth
+    // finalize redirect must still work.
+    const provider = new FreshnessProvider(['login'], NOW_MS - FIVE_SEC_MS);
+    const cookie = await mintSessionsCookie();
+
+    const res = await runAt(
+      provider,
+      cookie,
+      `?requestId=oidc_req1&sessionId=${SESSION.id}`,
+      NOW_MS
+    );
+
+    expect(res.status).toBe(302);
+    const loc = res.headers.get('location') ?? '';
+    expect(loc).toContain('client.acme.test/callback');
+    expect(loc).toContain(`code=fake_req1_${SESSION.id}`);
+    expect(loc).not.toContain('/login');
+  });
+
+  it('prompt=select_account + STALE handed-back session → still finalizes (gate is login-only)', async () => {
+    // Selecting your own live session is harmless: the gate must NOT apply to select_account,
+    // even with a stale factor. Confirms the hardening is scoped to prompt=login.
+    const provider = new FreshnessProvider(['select_account'], NOW_MS - TEN_MIN_MS);
+    const cookie = await mintSessionsCookie();
+
+    const res = await runAt(
+      provider,
+      cookie,
+      `?requestId=oidc_req1&sessionId=${SESSION.id}`,
+      NOW_MS
+    );
+
+    expect(res.status).toBe(302);
+    const loc = res.headers.get('location') ?? '';
+    expect(loc).toContain('client.acme.test/callback');
+    expect(loc).toContain(`code=fake_req1_${SESSION.id}`);
+    expect(loc).not.toContain('/accounts');
+  });
+});

app/resources/authorize/authorize.service.ts

@@ -20,8 +20,9 @@ import {
   serializeSessions,
   type SessionEntry,
 } from '@/modules/auth/session/cookie';
-import { ProviderError } from '@/modules/auth/types';
+import { ProviderError, type Session } from '@/modules/auth/types';
 import { decideAuthorize } from '@/resources/authorize/authorize-decision';
+import { primaryFresh } from '@/resources/shared/lifetimes';
 import { logAuthEvent } from '@/server/observability';
 import { type AuthErrorCode, providerErrorCode } from '@/utils/errors/auth-error';
 import { redirect } from 'react-router';
@@ -41,6 +42,13 @@ const DEAD_SESSION_CODES: ReadonlySet<ProviderError['code']> = new Set([
   'PERMISSION_DENIED',
 ]);
 
+// Freshness window for honoring a query-handed-back sessionId against a prompt=login request.
+// The post-auth finalize redirect is near-immediate (the ceremony hands the just-authenticated
+// session id straight back to /authorize), so 2 minutes generously covers redirect latency +
+// clock skew while keeping forced re-auth meaningful — a STALE session id forged onto the URL
+// can no longer satisfy prompt=login.
+const FRESH_LOGIN_WINDOW_MS = 2 * 60 * 1000; // 2 minutes
+
 /**
  * A typed description of what the /authorize loader resolved to. The route (and the
  * `outcomeToResponse` translator below) turn this into a redirect/JSON Response. Keeping
@@ -118,8 +126,9 @@ function errorRedirect(url: URL, code: AuthErrorCode): Response {
 /**
  * Validate that a cookie session is still alive before reusing it in createCallback.
  *
- * Returns an AuthorizeOutcome (caller must return it immediately) for the two non-alive
- * outcomes, and `null` only when the session is ALIVE (caller proceeds to createCallback):
+ * Returns an AuthorizeOutcome (which carries a `kind`; caller must return it immediately) for the
+ * two non-alive outcomes, and `{ session }` ONLY when the session is ALIVE (caller proceeds to the
+ * freshness gate / createCallback). Callers discriminate on `'kind' in result`:
  *
  *   • CONFIRMED DEAD — getSession → null, or a ProviderError with a DEAD_SESSION_CODES code:
  *     drop the stale entry from the cookie and re-prompt /login (self-heal; mirrors the SAML
@@ -131,6 +140,9 @@ function errorRedirect(url: URL, code: AuthErrorCode): Response {
  *     `oidc_callback` failure WITH the code so the transient is diagnosable. A Zitadel hiccup
  *     must never silently re-login a valid user, and must never be swallowed.
  *
+ *   • ALIVE — return the live `Session` so the caller can inspect its factors (the prompt=login
+ *     freshness gate needs `factors.*.verifiedAt`) before reusing it in createCallback.
+ *
  * Distinguishing dead vs transient by the error code is the critical precision that prevents
  * introducing a new bug (logging out a valid user on a transient blip).
  */
@@ -140,7 +152,7 @@ async function healIfSessionDead(
   entry: SessionEntry,
   requestId: string,
   rawId: string
-): Promise<AuthorizeOutcome | null> {
+): Promise<AuthorizeOutcome | { session: Session }> {
   let alive: Awaited<ReturnType<AuthProvider['getSession']>>;
   try {
     alive = await provider.getSession(entry.id, entry.token);
@@ -160,7 +172,7 @@ async function healIfSessionDead(
     return { kind: 'error-redirect', code: providerErrorCode(code) };
   }
   if (!alive) return healStaleEntry(list, entry, requestId, rawId); // confirmed dead
-  return null; // alive → proceed to createCallback
+  return { session: alive }; // alive → caller proceeds to the freshness gate / createCallback
 }
 
 /** Drop the stale entry, re-prompt /login, and emit a traceable session_stale event. */
@@ -265,7 +277,8 @@ async function resolveOidc(
   provider: AuthProvider,
   request: Request,
   url: URL,
-  requestId: string
+  requestId: string,
+  nowMs: number = Date.now()
 ): Promise<AuthorizeOutcome> {
   const rawId = requestId.replace('oidc_', '');
 
@@ -288,9 +301,21 @@ async function resolveOidc(
     if (entry) {
       // Validate liveness BEFORE reuse: a stale post-logout cookie self-heals to /login here
       // instead of reaching createCallback on a terminated session (→ ALREADY_DONE → /error).
-      const healed = await healIfSessionDead(provider, list, entry, requestId, rawId);
-      if (healed) return healed;
-      return runCallback(provider, rawId, entry);
+      const gate = await healIfSessionDead(provider, list, entry, requestId, rawId);
+      if ('kind' in gate) return gate; // dead/transient → outcome already decided
+
+      // ANTI-FORGERY FRESHNESS GATE (prompt=login only). The sessionId is query-supplied, so a
+      // caller can forge `&sessionId=<their_own_STALE_live_session>` onto a prompt=login request
+      // to skip the forced re-authentication the AS explicitly demanded. A handed-back session may
+      // satisfy prompt=login ONLY if it was genuinely freshly authenticated THIS ceremony (a
+      // primary factor verified within FRESH_LOGIN_WINDOW_MS). If it is stale, fall through to
+      // decideAuthorize, which routes prompt=login → /login (forced re-auth). select_account is
+      // harmless (picking your own live session), so the gate is scoped to prompt=login.
+      const mustReauth =
+        authRequest.prompt.includes('login') &&
+        !primaryFresh(gate.session.factors, nowMs, FRESH_LOGIN_WINDOW_MS);
+      if (!mustReauth) return runCallback(provider, rawId, entry);
+      // else: stale prompt=login → do NOT finalize; fall through to decideAuthorize below.
     }
   }
 
@@ -304,9 +329,11 @@ async function resolveOidc(
   if (decision.target === 'callback') {
     const entry = byId(list, decision.params?.sessionId ?? '');
     if (!entry) return { kind: 'error-redirect', code: 'no_session' };
-    // Validate liveness BEFORE reuse (same self-heal as the explicit-sessionId path above).
+    // Validate liveness BEFORE reuse (same self-heal as the explicit-sessionId path above). No
+    // freshness gate here: for prompt=login decideAuthorize returns target '/login', never
+    // 'callback', so this branch is unreachable under prompt=login (only none/default reuse).
     const healed = await healIfSessionDead(provider, list, entry, requestId, rawId);
-    if (healed) return healed;
+    if ('kind' in healed) return healed;
     return runCallback(provider, rawId, entry);
   }
   if (decision.target === 'error') {
@@ -332,7 +359,8 @@ async function resolveOidc(
  */
 export async function resolveAuthorize(
   provider: AuthProvider,
-  request: Request
+  request: Request,
+  nowMs: number = Date.now()
 ): Promise<AuthorizeOutcome> {
   const url = new URL(request.url);
   const requestId = normalizeRequestId(url);
@@ -344,5 +372,5 @@ export async function resolveAuthorize(
 
   if (requestId.startsWith('saml_')) return resolveSaml(provider, request, requestId);
   if (requestId.startsWith('device_')) return resolveDevice(requestId);
-  return resolveOidc(provider, request, url, requestId);
+  return resolveOidc(provider, request, url, requestId, nowMs);
 }