@@ -56,6 +56,28 @@ func ExtractOAuth2(config OAuth2Config, client *http.Client) func(http.Handler)
5656return
5757}
5858
59+ // OIDC errors can be returned as query parameters. This can happen
60+ // if for example we are providing and invalid scope.
61+ // We should terminate the OIDC process if we encounter an error.
62+ oidcError := r .URL .Query ().Get ("error" )
63+ errorDescription := r .URL .Query ().Get ("error_description" )
64+ errorURI := r .URL .Query ().Get ("error_uri" )
65+ if oidcError != "" {
66+ // Combine the errors into a single string if either is provided.
67+ if errorDescription == "" && errorURI != "" {
68+ errorDescription = fmt .Sprintf ("error_uri: %s" ,errorURI )
69+ }else if errorDescription != "" && errorURI != "" {
70+ errorDescription = fmt .Sprintf ("%s, error_uri: %s" ,errorDescription ,errorURI )
71+ }
72+ oidcError = fmt .Sprintf ("Encountered error in oidc process: %s" ,oidcError )
73+ httpapi .Write (ctx ,rw ,http .StatusBadRequest , codersdk.Response {
74+ Message :oidcError ,
75+ // This message might be blank. This is ok.
76+ Detail :errorDescription ,
77+ })
78+ return
79+ }
80+
5981code := r .URL .Query ().Get ("code" )
6082state := r .URL .Query ().Get ("state" )
6183