Mar 10, 2023 · Mar 10, 2023 · Mar 10, 2023 · Mar 10, 2023 · Mar 10, 2023
diff --git a/coderd/httpmw/oauth2.go b/coderd/httpmw/oauth2.go
 return
 }

 // OIDC errors can be returned as query parameters. This can happen
 // if for example we are providing and invalid scope.
 // We should terminate the OIDC process if we encounter an error.
 oidcError := r.URL.Query().Get("error")
 errorDescription := r.URL.Query().Get("error_description")
 errorURI := r.URL.Query().Get("error_uri")
 if oidcError != "" {
 // Combine the errors into a single string if either is provided.
 if errorDescription == "" && errorURI != "" {
 errorDescription = fmt.Sprintf("error_uri: %s", errorURI)
 } else if errorDescription != "" && errorURI != "" {
 errorDescription = fmt.Sprintf("%s, error_uri: %s", errorDescription, errorURI)
 }
 oidcError = fmt.Sprintf("Encountered error in oidc process: %s", oidcError)
 httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 Message: oidcError,
 // This message might be blank. This is ok.
 Detail: errorDescription,
 })
 return
 }

 code := r.URL.Query().Get("code")
 state := r.URL.Query().Get("state")
Original file line number	Diff line number	Diff line change
Expand Up		@@ -56,6 +56,28 @@ func ExtractOAuth2(config OAuth2Config, client *http.Client) func(http.Handler)
		return
		}

		// OIDC errors can be returned as query parameters. This can happen
		// if for example we are providing and invalid scope.
		// We should terminate the OIDC process if we encounter an error.
		oidcError := r.URL.Query().Get("error")
		errorDescription := r.URL.Query().Get("error_description")
Copy link Member johnstcnMar 10, 2023 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. Perthe OIDC spec only the`error` response parameter is required; the`error_description` field is optional so we should handle that being blank. Also there is an`error_uri` parameter that might be present so we should check for that as well. Copy link MemberAuthor EmyrkMar 10, 2023 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. I do handle an empty`error_description`. The`Details` part of the error is extra developer debug info. If it is empty, we provide no extra details, since we have no extra information. I can add`error_uri` though 👍
		errorURI := r.URL.Query().Get("error_uri")
		if oidcError != "" {
		// Combine the errors into a single string if either is provided.
		if errorDescription == "" && errorURI != "" {
		errorDescription = fmt.Sprintf("error_uri: %s", errorURI)
		} else if errorDescription != "" && errorURI != "" {
		errorDescription = fmt.Sprintf("%s, error_uri: %s", errorDescription, errorURI)
		}
		oidcError = fmt.Sprintf("Encountered error in oidc process: %s", oidcError)
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
		Message: oidcError,
		// This message might be blank. This is ok.
		Detail: errorDescription,
		})
		return
		}

		code := r.URL.Query().Get("code")
		state := r.URL.Query().Get("state")

Expand Down