Step up authentication with Angular customised route guard

HI there,

I'm trying to configure step-up 2FA authentication in an Angular app using:

• Okta classic engine (Version 2026.08.3 C)
• @okta/okta-angular@8.0.0
• @okta/okta-auth-js@8.0.1

I want the step-up authentication to happen every time (ie max age 0) a user tries to access specific Angular routes. I have discovered that the canActivateAuthGuard() functions provided by @okta/okta-angular do not support checks of the max age, only the ACR value. Consequently the path forward is a custom auth guard function.

I created the custom function & configured a route to use it.

When a user attempts to access the route they get challenged for a 2FA (Okta verify). However, the user never gets returned to the target route. Instead they end up in a constant loop being prompted for the 2FA (Okta Verify).

I've provided a copy of the custom auth guard code below.

Any suggestions/assistance would be greatly appreciated.

Thanks

-------------------------

export const canActivateStepUpGuard: CanActivateFn = async (route, state) => {

  const oktaAuth = inject(OKTA_AUTH);

  // Check if the user is authenticated

  const isAuthenticated = await oktaAuth.isAuthenticated();

  if (!isAuthenticated) {

    oktaAuth.setOriginalUri(state.url);

    await oktaAuth.signInWithRedirect();

    return false;

  }

  // Get the user's ID token

  const idToken = oktaAuth.getIdToken();

  if (idToken == undefined) {

    oktaAuth.setOriginalUri(state.url);

    await oktaAuth.signInWithRedirect();

    return false;

  }

  // Check that the authentication time is recent enough

  const tokenClaims = oktaAuth.token.decode(idToken);

  const authTime = tokenClaims.payload.auth_time;

  const currentTime = Math.floor(Date.now() / 1000);

  if (!authTime || (currentTime - authTime) > 60) {

    // If the authentication time is too old, force step-up authentication  

    oktaAuth.setOriginalUri(state.url);

    await oktaAuth.signInWithRedirect(

      {

        acrValues: "urn:okta:loa:2fa:any",

        maxAge: 60,

        originalUri: state.url

      }

    );

    return false;

  }

  return true;

}