store timestamp into session, not state

Author: restena-sw

src/Auth/Process/WebAuthn.php

@@ -142,17 +142,17 @@ public function process(array &$state): void {
             unset($state['Attributes']['internal:FIDO2PasswordlessAuthentication']);
             return;
         }
-
+        $session = Session::getSessionFromRequest();
+        $lastSecondFactor = $session->getData("DateTime", 'LastSuccessfulSecondFactor');
         if // do we need to do secondFactor in interval, or even every time?
            // we skip only if an interval is configured AND we did successfully authenticate, AND are within the interval
         (
                 $this->SecondFactorMaxAge >= 0 && // 
                 (
-                isset($state['Attributes']['LastSuccessfulSecondFactor']) &&
-                $state['Attributes']['LastSuccessfulSecondFactor'] instanceof \DateTime
+                $lastSecondFactor instanceof \DateTime
                 )
         ) {
-            $interval = \DateTime::diff($state['Attributes']['LastSuccessfulSecondFactor'], \DateTime());
+            $interval = \DateTime::diff($lastSecondFactor, \DateTime());
             if ($interval->invert == 1) {
                 throw new \Exception("We are talking to a future self. Amazing.");
             }

src/Controller/AuthProcess.php

@@ -231,7 +231,7 @@ function (WebAuthnAuthenticationEvent $authObject, array $state) {
             // take note of the current timestamp so we know 
             // a) that second-factor was done successfully in the current sesssion
             // b) when that event occured, so as to make regular re-auths configurable
-            $state['Attributes']['LastSuccessfulSecondFactor'] = new \DateTime();
+            $this->session->setData("DateTime", 'LastSuccessfulSecondFactor', new \DateTime());
             $this->authState::saveState($state, 'webauthn:request');
         }
         if ($state['FIDO2PasswordlessAuthMode'] === true) {