fix: verify auth_time against per-request max_age (#1792)

### Changes

`max_age` passed per call (e.g. `loginWithRedirect({
authorizationParams: { max_age: 0 } })`) was sent to `/authorize` but
not used when verifying the returned ID token. Only the `max_age` set on
the client was checked, so `auth_time` validation was skipped for
per-request `max_age`.

- `_prepareAuthorizeUrl` now returns the effective `max_age`; it is
stored in the login transaction (redirect) or kept in memory (popup,
silent iframe) and passed to `_verifyIdToken`, falling back to the
client-level value.
- `parseNumber('0')` now returns `0` instead of `undefined`.
- `verify()` now requires `auth_time` when `max_age` is `0`.

### References

[OIDC Core §3.1.3.7 — ID Token
Validation](https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation),
item 13 (`auth_time` must be checked when `max_age` is requested).

### Testing

Added unit tests for per-request `max_age` in `loginWithRedirect`,
`loginWithPopup` and `getTokenSilently`, plus `max_age: 0` handling in
`jwt.verify` and `parseNumber`. The full unit suite passes.

- [x] This change adds unit test coverage
- [ ] This change adds integration test coverage
- [x] This change has been tested on the latest version of the
platform/language

### Checklist

- [x] I have read the [Auth0 general contribution
guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md)
- [x] I have read the [Auth0 Code of
Conduct](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md)
- [x] All code quality tools/guidelines have been run/followed

🤖 Generated with [Claude Code](https://claude.com/claude-code)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* `max_age` settings are now applied consistently during popup,
redirect, and silent sign-ins. Values supplied for a specific sign-in
take precedence over the client’s configured value.
* A `max_age` of `0` is now preserved and enforced during ID token
verification, including the required `auth_time` claim check.
* Numeric string values for `max_age`, including `"0"`, are now
correctly recognized as numbers.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Claude <noreply@anthropic.com>

Author: yogeshchoudhary147

__tests__/Auth0Client/getTokenSilently.test.ts

@@ -2242,6 +2242,26 @@ describe('Auth0Client', () => {
       );
     });
 
+    it('calls `tokenVerifier.verify` with the `max_age` given in the method', async () => {
+      const auth0 = setup();
+
+      jest.spyOn(<any>utils, 'runIframe').mockResolvedValue({
+        access_token: TEST_ACCESS_TOKEN,
+        state: TEST_STATE
+      });
+
+      await getTokenSilently(auth0, {
+        authorizationParams: { max_age: 0 },
+        cacheMode: 'off'
+      });
+
+      expect(tokenVerifier).toHaveBeenCalledWith(
+        expect.objectContaining({
+          max_age: 0
+        })
+      );
+    });
+
     it('throws error if state from popup response is different from the provided state', async () => {
       const auth0 = setup();
 

__tests__/Auth0Client/loginWithPopup.test.ts

@@ -566,6 +566,32 @@ describe('Auth0Client', () => {
       );
     });
 
+    it('calls `tokenVerifier.verify` with the `max_age` given in the login method', async () => {
+      const auth0 = setup({ authorizationParams: { max_age: 3600 } });
+
+      await loginWithPopup(auth0, {
+        authorizationParams: { max_age: 0 }
+      });
+
+      expect(tokenVerifier).toHaveBeenCalledWith(
+        expect.objectContaining({
+          max_age: 0
+        })
+      );
+    });
+
+    it('calls `tokenVerifier.verify` with the parsed `max_age` string "0" from constructor', async () => {
+      const auth0 = setup({ authorizationParams: { max_age: '0' } });
+
+      await loginWithPopup(auth0);
+
+      expect(tokenVerifier).toHaveBeenCalledWith(
+        expect.objectContaining({
+          max_age: 0
+        })
+      );
+    });
+
     it('calls `tokenVerifier.verify` with the organization', async () => {
       const auth0 = setup({
         authorizationParams: { organization: 'org_123' }

__tests__/Auth0Client/loginWithRedirect.test.ts

@@ -528,6 +528,34 @@ describe('Auth0Client', () => {
       );
     });
 
+    it('calls `tokenVerifier.verify` with the `max_age` given in the login method', async () => {
+      const auth0 = setup();
+
+      await loginWithRedirect(auth0, {
+        authorizationParams: { max_age: 0 }
+      });
+
+      expect(tokenVerifier).toHaveBeenCalledWith(
+        expect.objectContaining({
+          max_age: 0
+        })
+      );
+    });
+
+    it('calls `tokenVerifier.verify` with the `max_age` given in the login method over the one from constructor', async () => {
+      const auth0 = setup({ authorizationParams: { max_age: 3600 } });
+
+      await loginWithRedirect(auth0, {
+        authorizationParams: { max_age: '10' }
+      });
+
+      expect(tokenVerifier).toHaveBeenCalledWith(
+        expect.objectContaining({
+          max_age: 10
+        })
+      );
+    });
+
     it('calls `tokenVerifier.verify` with the global organization', async () => {
       const auth0 = setup({
         authorizationParams: { organization: 'org_123' }

__tests__/jwt.test.ts

@@ -370,6 +370,14 @@ describe('jwt', () => {
     );
   });
 
+  it('validate auth_time is present when max_age is 0', async () => {
+    const id_token = await createJWT({ ...DEFAULT_PAYLOAD });
+
+    expect(() => verify({ ...verifyOptions, id_token, max_age: 0 })).toThrow(
+      'Authentication Time (auth_time) claim must be a number present in the ID token when Max Age (max_age) is specified'
+    );
+  });
+
   it('validate auth_time + max_age is in the future', async () => {
     const yesterday = new Date();
     yesterday.setDate(yesterday.getDate() - 1);

__tests__/utils.test.ts

@@ -12,6 +12,7 @@ import {
   getCrypto,
   validateCrypto,
   fromEntries,
+  parseNumber,
   stripAuth0Client
 } from '../src/utils';
 
@@ -560,6 +561,23 @@ describe('utils', () => {
     });
   });
 
+  describe('parseNumber', () => {
+    it('parses numeric strings, including "0"', () => {
+      expect(parseNumber('10')).toBe(10);
+      expect(parseNumber('0')).toBe(0);
+    });
+
+    it('returns undefined for non-numeric strings', () => {
+      expect(parseNumber('')).toBeUndefined();
+      expect(parseNumber('abc')).toBeUndefined();
+    });
+
+    it('returns non-string values as-is', () => {
+      expect(parseNumber(0)).toBe(0);
+      expect(parseNumber(undefined)).toBeUndefined();
+    });
+  });
+
   describe('fromEntries', () => {
     const data = { a: 'b', c: 'd' };
     const iterable = new Headers(data);

src/Auth0Client.ts

@@ -462,7 +462,8 @@ export class Auth0Client {
   private async _verifyIdToken(
     id_token: string,
     nonce?: string,
-    organization?: string
+    organization?: string,
+    max_age?: string | number
   ) {
     const now = await this.nowProvider();
 
@@ -473,7 +474,9 @@ export class Auth0Client {
       nonce,
       organization,
       leeway: this.options.leeway,
-      max_age: parseNumber(this.options.authorizationParams.max_age),
+      max_age: parseNumber(
+        max_age ?? this.options.authorizationParams.max_age
+      ),
       now
     });
   }
@@ -561,6 +564,7 @@ export class Auth0Client {
     code_verifier: string;
     state: string;
     url: string;
+    max_age?: string | number;
   }> {
     const state = encode(createRandomString());
     const nonce = encode(createRandomString());
@@ -592,7 +596,8 @@ export class Auth0Client {
       audience: params.audience || DEFAULT_AUDIENCE,
       redirect_uri: params.redirect_uri,
       state,
-      url
+      url,
+      max_age: params.max_age
     };
   }
 
@@ -678,7 +683,8 @@ export class Auth0Client {
       },
       {
         nonceIn: params.nonce,
-        organization
+        organization,
+        max_age: params.max_age
       }
     );
   }
@@ -862,7 +868,7 @@ export class Auth0Client {
         code: code as string,
         ...(redirect_uri ? { redirect_uri } : {})
       },
-      { nonceIn, organization }
+      { nonceIn, organization, max_age: transaction.max_age }
     );
 
     return {
@@ -1490,7 +1496,8 @@ export class Auth0Client {
             code_verifier,
             redirect_uri,
             scope,
-            audience
+            audience,
+            max_age
           } = await this._prepareAuthorizeUrl(
             params,
             { response_mode: 'web_message' },
@@ -1539,7 +1546,8 @@ export class Auth0Client {
             },
             {
               nonceIn,
-              organization: params.organization
+              organization: params.organization,
+              max_age
             }
           );
 
@@ -1898,7 +1906,8 @@ export class Auth0Client {
       | WebauthnRequestTokenOptions,
     additionalParameters?: RequestTokenAdditionalParameters
   ) {
-    const { nonceIn, organization, scopesToRequest } = additionalParameters || {};
+    const { nonceIn, organization, scopesToRequest, max_age } =
+      additionalParameters || {};
     try {
       const authResult = await oauthToken(
         {
@@ -1919,7 +1928,8 @@ export class Auth0Client {
       let decodedToken = await this._verifyIdToken(
         authResult.id_token,
         nonceIn,
-        organization
+        organization,
+        max_age
       );
 
       // When logging in with authorization_code, check if a different user is authenticating
@@ -2478,4 +2488,5 @@ interface RequestTokenAdditionalParameters {
   nonceIn?: string;
   organization?: string;
   scopesToRequest?: string;
+  max_age?: string | number;
 }

src/jwt.ts

@@ -140,7 +140,7 @@ export const verify = (options: JWTVerifyOptions) => {
     }
   }
 
-  if (options.max_age && !isNumber(decoded.claims.auth_time)) {
+  if (options.max_age != null && !isNumber(decoded.claims.auth_time)) {
     throw new Error(
       'Authentication Time (auth_time) claim must be a number present in the ID token when Max Age (max_age) is specified'
     );

src/transaction-manager.ts

@@ -11,6 +11,7 @@ export interface LoginTransaction {
   redirect_uri?: string;
   organization?: string;
   state?: string;
+  max_age?: string | number;
   response_type: 'code';
 }
 

src/utils.ts

@@ -297,7 +297,8 @@ export const parseNumber = (value: any): number | undefined => {
   if (typeof value !== 'string') {
     return value;
   }
-  return parseInt(value, 10) || undefined;
+  const parsed = parseInt(value, 10);
+  return isNaN(parsed) ? undefined : parsed;
 };
 
 /**