From a8433b18e431a356f7e6b99d7acb30afe5871113 Mon Sep 17 00:00:00 2001 From: Steven Masley Date: Fri, 10 Mar 2023 10:12:29 -0600 Subject: [PATCH] fix: Prevent infinite redirects on oidc errors (#6550) * fix: Prevent infinite redirects on bad oidc scopes * Show oidc errors --- coderd/httpmw/oauth2.go | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/coderd/httpmw/oauth2.go b/coderd/httpmw/oauth2.go index 820523b6be..26c4ff63d7 100644 --- a/coderd/httpmw/oauth2.go +++ b/coderd/httpmw/oauth2.go @@ -56,6 +56,28 @@ func ExtractOAuth2(config OAuth2Config, client *http.Client) func(http.Handler) return } + // OIDC errors can be returned as query parameters. This can happen + // if for example we are providing and invalid scope. + // We should terminate the OIDC process if we encounter an error. + oidcError := r.URL.Query().Get("error") + errorDescription := r.URL.Query().Get("error_description") + errorURI := r.URL.Query().Get("error_uri") + if oidcError != "" { + // Combine the errors into a single string if either is provided. + if errorDescription == "" && errorURI != "" { + errorDescription = fmt.Sprintf("error_uri: %s", errorURI) + } else if errorDescription != "" && errorURI != "" { + errorDescription = fmt.Sprintf("%s, error_uri: %s", errorDescription, errorURI) + } + oidcError = fmt.Sprintf("Encountered error in oidc process: %s", oidcError) + httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{ + Message: oidcError, + // This message might be blank. This is ok. + Detail: errorDescription, + }) + return + } + code := r.URL.Query().Get("code") state := r.URL.Query().Get("state")