From b2809636a71dcc45c2bb67bb9acbf77032f769aa Mon Sep 17 00:00:00 2001 From: Bereket Engida <86073083+Bekacru@users.noreply.github.com> Date: Fri, 14 Nov 2025 20:07:23 -0800 Subject: [PATCH] Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- .../src/plugins/oidc-provider/authorize.ts | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/packages/better-auth/src/plugins/oidc-provider/authorize.ts b/packages/better-auth/src/plugins/oidc-provider/authorize.ts index 016cc512fe..e351578c72 100644 --- a/packages/better-auth/src/plugins/oidc-provider/authorize.ts +++ b/packages/better-auth/src/plugins/oidc-provider/authorize.ts @@ -240,12 +240,16 @@ export async function authorize( // max_age=0 is equivalent to prompt=login let requireLogin = promptSet.has("login"); if (query.max_age !== undefined) { - const sessionAge = - (Date.now() - new Date(session.session.createdAt).getTime()) / 1000; - if (sessionAge > query.max_age) { - // Session is older than max_age, force reauthentication - requireLogin = true; + const maxAge = Number(query.max_age); + if (Number.isInteger(maxAge) && maxAge >= 0) { + const sessionAge = + (Date.now() - new Date(session.session.createdAt).getTime()) / 1000; + if (sessionAge > maxAge) { + // Session is older than max_age, force reauthentication + requireLogin = true; + } } + // If max_age is invalid (not a non-negative integer), ignore it per OIDC spec } const requireConsent =