fix(trueforge): keep OIDC exchange failures out of the error redirect - #687
Open
CaptainAni187 wants to merge 1 commit into
Open
fix(trueforge): keep OIDC exchange failures out of the error redirect#687CaptainAni187 wants to merge 1 commit into
CaptainAni187 wants to merge 1 commit into
Conversation
The callback handler curates the IdP error branch carefully, then reflects the raw exception from the token exchange into /?error=. openid-client embeds the token-endpoint response and issuer host in that message, so internal detail reached the browser's address bar, where it persists in history and support screenshots. An attacker who induces a failing exchange also controlled that text on a trusted origin. Use the same generic login_failed reason as the neighbouring paths; the full error already goes to the logger above via extractErrorLogFields. Fixes truefoundry#422
CaptainAni187
requested review from
bhaveshpatel640,
chiragjn,
debajyoti-truefoundry,
heerambavi1998,
sr07asthana and
thesujai
as code owners
September 10, 2026 19:14
🦋 Changeset detectedLatest commit: e501fb4 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The callback handler is deliberate about the IdP error branch, then reflects the raw token-exchange exception into
/?error=. That message comes fromopenid-clientand embeds the token-endpoint response and issuer host, so internal detail ends up in the address bar, browser history and support screenshots. Since the state cookie is set by any unauthenticated/auth/loginvisit, an attacker who induces a failing exchange also controls that text on a trusted origin.Closes #422
Changes
login_failedreason as the neighbouring paths. Full detail already goes to the logger above viaextractErrorLogFields, so nothing is lost for debugging.How was this tested?
jest --config jest.unit.config.cjs tests/unit/apis/auth.test.ts— 24 pass. Reverting the one line fails the new case, and the received value shows what was leaking:Checklist
format:checkpasses repo-wide and eslint is clean on the touched files; ran the package's unit suite rather than the fullpnpm test. Repo-widelint:cihas 55 pre-existing errors, all inpackages/frontend/*andDropdownMenu.tsx, none in files this PR touches.env.example— not applicableChangeset included. On process: CONTRIBUTING asks for approval first, and all six
help wantedissues are assigned or already have PRs, so there was nothing approved to pick up. Close this if you'd rather it went through the queue.