Mar 10, 2023 · Mar 10, 2023 · Mar 10, 2023 · Mar 10, 2023 · Mar 10, 2023 · Mar 10, 2023
diff --git a/coderd/httpmw/oauth2.go b/coderd/httpmw/oauth2.go
 // We should terminate the OIDC process if we encounter an error.
 oidcError := r.URL.Query().Get("error")
 errorDescription := r.URL.Query().Get("error_description")
 errorURI := r.URL.Query().Get("error_uri")
 if oidcError != "" {
 // Combine the errors into a single string if either is provided.
 if errorDescription == "" && errorURI != "" {
 errorDescription = fmt.Sprintf("error_uri: %s", errorURI)
 } else if errorDescription != "" && errorURI != "" {
 errorDescription = fmt.Sprintf("%s, error_uri: %s", errorDescription, errorURI)
 }
 oidcError = fmt.Sprintf("Encountered error in oidc process: %s", oidcError)
 httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 Message: oidcError,
 //errorDescriptionisoptional.
 //This message might be blank. Thisisok.
 Detail: errorDescription,
 })
 return
Original file line number	Diff line number	Diff line change
Expand Up		@@ -61,11 +61,18 @@ func ExtractOAuth2(config OAuth2Config, client *http.Client) func(http.Handler)
		// We should terminate the OIDC process if we encounter an error.
		oidcError := r.URL.Query().Get("error")
		errorDescription := r.URL.Query().Get("error_description")
Copy link Member johnstcnMar 10, 2023 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. Perthe OIDC spec only the`error` response parameter is required; the`error_description` field is optional so we should handle that being blank. Also there is an`error_uri` parameter that might be present so we should check for that as well. Copy link MemberAuthor EmyrkMar 10, 2023 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. I do handle an empty`error_description`. The`Details` part of the error is extra developer debug info. If it is empty, we provide no extra details, since we have no extra information. I can add`error_uri` though 👍
		errorURI := r.URL.Query().Get("error_uri")
		if oidcError != "" {
		// Combine the errors into a single string if either is provided.
		if errorDescription == "" && errorURI != "" {
		errorDescription = fmt.Sprintf("error_uri: %s", errorURI)
		} else if errorDescription != "" && errorURI != "" {
		errorDescription = fmt.Sprintf("%s, error_uri: %s", errorDescription, errorURI)
		}
		oidcError = fmt.Sprintf("Encountered error in oidc process: %s", oidcError)
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
		Message: oidcError,
		//errorDescriptionisoptional.
		//This message might be blank. Thisisok.
		Detail: errorDescription,
		})
		return
Expand Down