Fixes#18201

Problem

When OIDC sessions expire or authentication fails, users see ugly raw JSON error responses instead of being redirected to a user-friendly login page with clear error messages.

Before:

{"message":"Failed exchanging Oauth code.","detail":"oauth2:\"invalid_grant\"\"AADSTS54005: OAuth2 Authorization code was already redeemed...\""}

After:
Users are redirected to/login?message=Authentication+failed%3A+Session+expired%2C+please+sign+in+again

Solution

Modified the OAuth2 middleware (coderd/httpmw/oauth2.go) to redirect to the login page instead of returning JSON errors for OIDC authentication failures.

Changes Made

• OIDC Provider Errors: Redirect with user-friendly "Authentication failed" messages
• Session Expiry: Redirect with "Session expired, please sign in again" for missing/mismatched cookies
• State Issues: Redirect with appropriate error messages for invalid authentication state
• OAuth Exchange Failures: Redirect with detailed error information (except device flow)
• Preserved Device Flow: Still returns JSON forauthorization_pending as expected by OAuth device flow clients

Error Message Examples

• Authentication failed: Session expired, please sign in again (for expired sessions)
• Authentication failed: invalid_request - The request is missing a required parameter (for OIDC provider errors)
• Authentication failed: Invalid authentication state (for missing state)

Testing

• ✅ All existing tests updated and passing
• ✅ Added comprehensive test coverage for redirect functionality:
  • OIDCErrorRedirectsToLogin: Tests OIDC provider error parameters
  • NoStateRedirectsToLogin: Tests missing state parameter
  • NoStateCookieRedirectsToLogin: Tests missing session cookie
  • MismatchedStateRedirectsToLogin: Tests state mismatch scenarios
• ✅ Verified existing authentication flows remain unchanged
• ✅ Confirmed device flow still works correctly

Impact

This significantly improves the user experience when OIDC authentication fails, especially for session expiry scenarios. Users now get a proper login page with clear instructions instead of confusing JSON errors.