# Step up authentication with Angular customised route guard **URL:** \ **Category:** OAuth/OIDC\ **Created:** [August 31, 2026, 9:54pm UTC](https://devforum.okta.com/t/step-up-authentication-with-angular-customised-route-guard/35447 "2026-08-31T21:54:14Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![tim2026](https://avatars.discourse-cdn.com/v4/letter/t/e0b2c6/32.png) [@tim2026](https://devforum.okta.com/u/tim2026)\ **Post date:** [August 31, 2026, 9:54pm UTC](https://devforum.okta.com/t/step-up-authentication-with-angular-customised-route-guard/35447/1 "2026-08-31T21:54:14Z")
Hi there, I’m trying to configure step-up 2FA authentication in an Angular app using: - Okta classic engine (Version 2026.08.3 C) - @oktaokta/[okta-angular@8.0.0](mailto:okta-angular@8.0.0)@okta - @okta/[okta-auth-js@8.0.1](mailto:okta-auth-js@8.0.1) I want the step-up authentication to happen every time (ie max age 0) a user tries to access specific Angular routes. I have discovered that the canActivateAuthGuard() functions provided by @okta/okta-angular do not support checks of the max age, only the ACR value. Consequently the path forward is a custom auth guard function. I created the custom function & configured a route to use it. When a user attempts to access the route they get challenged for a 2FA (Okta verify). However, the user never gets returned to the target route. Instead they end up in a constant loop being prompted for the 2FA (Okta Verify). I’ve provided a copy of the custom auth guard code below. Any suggestions/assistance would be greatly appreciated. Thanks ------------------------- ```auto export const canActivateStepUpGuard: CanActivateFn = async (route, state) => { const oktaAuth = inject(OKTA_AUTH); // Check if the user is authenticated const isAuthenticated = await oktaAuth.isAuthenticated(); if (!isAuthenticated) { oktaAuth.setOriginalUri(state.url); await oktaAuth.signInWithRedirect(); return false; } // Get the user's ID token const idToken = oktaAuth.getIdToken(); if (idToken == undefined) { oktaAuth.setOriginalUri(state.url); await oktaAuth.signInWithRedirect(); return false; } // Check that the authentication time is recent enough const tokenClaims = oktaAuth.token.decode(idToken); const authTime = tokenClaims.payload.auth_time; const currentTime = Math.floor(Date.now() / 1000); if (!authTime || (currentTime - authTime) > 60) { // If the authentication time is too old, force step-up authentication oktaAuth.setOriginalUri(state.url); await oktaAuth.signInWithRedirect( { acrValues: "urn:okta:loa:2fa:any", maxAge: 60, originalUri: state.url } ); return false; } return true; } ``` ---
**Author:** ![tim2026](https://avatars.discourse-cdn.com/v4/letter/t/e0b2c6/32.png) [@tim2026](https://devforum.okta.com/u/tim2026)\ **Post date:** [September 1, 2026, 12:26am UTC](https://devforum.okta.com/t/step-up-authentication-with-angular-customised-route-guard/35447/2 "2026-09-01T00:26:58Z")
One further detail I just noticed… It appears that the ID token auth\_time is not being updated during the step up authentication process. I tried setting maxAge to 1 & also setting prompt to login in the signInWithRedirect() call but the auth\_time did not change. ---
**Author:** ![ashutosh.sahu](https://avatars.discourse-cdn.com/v4/letter/a/5f9b8f/32.png) [@ashutosh.sahu](https://devforum.okta.com/u/ashutosh.sahu)\ **Post date:** [September 2, 2026, 8:55am UTC](https://devforum.okta.com/t/step-up-authentication-with-angular-customised-route-guard/35447/3 "2026-09-02T08:55:31Z")
Hi, Your loop isn’t caused by Okta failing to refresh auth\_time — it’s the guard checking the wrong claim. Per Okta’s step-up authentication guide, the claim that confirms step-up succeeded is **acr** , not auth\_time. auth\_time records when the _original_ authentication happened and isn’t guaranteed to change on every step-up round trip the way your (currentTime - authTime) \> 60 check assumes. That’s why it stayed flat even after you switched to maxAge: 1 and prompt: ‘login’ — you were reading a claim that was never meant to signal "step-up just completed. Could you please rewrite your code to check acr against your required Level of Authentication instead of auth\_time age? Thanks, Ashutosh ---
**Author:** ![tim2026](https://avatars.discourse-cdn.com/v4/letter/t/e0b2c6/32.png) [@tim2026](https://devforum.okta.com/u/tim2026)\ **Post date:** [September 2, 2026, 11:49pm UTC](https://devforum.okta.com/t/step-up-authentication-with-angular-customised-route-guard/35447/4 "2026-09-02T23:49:37Z")
Hi Ashutosh, Thanks for the info. Any chance you can provide a link to the step-up auth guide you’re referring to? Thanks for the tip on auth\_time not being modified on step-up - I thought I had read somewhere that it does get updated if you make the call to signInWithRedirect() & include the prompt=login option. I need a way to validate the age of the acr claim so that if it’s older than x then call signInWithRedirect(). From what I can see, once you have called signInWithRedirect() with the acrValues option the acr claim remains & is not cleared. Any suggestions? ---
**Author:** ![ashutosh.sahu](https://avatars.discourse-cdn.com/v4/letter/a/5f9b8f/32.png) [@ashutosh.sahu](https://devforum.okta.com/u/ashutosh.sahu)\ **Post date:** [September 4, 2026, 6:32am UTC](https://devforum.okta.com/t/step-up-authentication-with-angular-customised-route-guard/35447/5 "2026-09-04T06:32:23Z")
Hi Tim, You can use the below documentation for Step-up authentication and it’s implementation using Angular: - [Add Step-up Authentication Using Angular and NestJS | Okta Developer](https://developer.okta.com/blog/2024/03/12/stepup-authentication?via=dailydev) - [Step-up authentication using ACR values | Okta Developer](https://developer.okta.com/docs/guides/step-up-authentication/-/main/) Thanks, Ashutosh ---
**Author:** ![tim2026](https://avatars.discourse-cdn.com/v4/letter/t/e0b2c6/32.png) [@tim2026](https://devforum.okta.com/u/tim2026)\ **Post date:** [September 4, 2026, 9:16pm UTC](https://devforum.okta.com/t/step-up-authentication-with-angular-customised-route-guard/35447/6 "2026-09-04T21:16:28Z")
Hi Ashutosh, Thanks - I’ve already read both of those articles. They do not provide any details on how to check the age of an acr claim. Do you have any suggestion on how to validate the age of the acr claim? Thanks again ---
**Author:** ![alisaduncan](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/alisaduncan/32/3429_2.png) [@alisaduncan](https://devforum.okta.com/u/alisaduncan)\ **Post date:** [September 8, 2026, 3:55pm UTC](https://devforum.okta.com/t/step-up-authentication-with-angular-customised-route-guard/35447/7 "2026-09-08T15:55:34Z")
Hi @tim2026 ! Welcome to the community! You are correct, the current `canActivateAuthGuard()` only support `acr`, but I highly recommend creating an issue against the Okta Angular library requesting this feature if you require it. > **[Issues · okta/okta-angular](https://github.com/okta/okta-angular/issues)** > > Angular SDK for Okta's OIDC flow. Contribute to okta/okta-angular development by creating an account on GitHub. I haven’t tried looking at evaluating `max_age` step up checks client-side, only in the resource server against the access token. I’ll try to take a look at the id token when I can (but warning you it might be a bit before I can get to it). Just in case, here’s my demo app showing authn recency check in an Angular + .NET API where I poked at this scenario a bit for a talk I gave. > **[GitHub - alisaduncan/stepup-angular-dotnet-demo at completed](https://github.com/alisaduncan/stepup-angular-dotnet-demo/tree/completed)** > > completed Let us know if you are able to figure things out! ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [October 8, 2026, 3:56pm UTC](https://devforum.okta.com/t/step-up-authentication-with-angular-customised-route-guard/35447/8 "2026-10-08T15:56:01Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.