From d9dfe72aabaa2435ba1fb1e4c48088287b04e6e8 Mon Sep 17 00:00:00 2001 From: Lucas Berger Date: Mon, 15 Jun 2026 16:18:10 -0400 Subject: [PATCH] fix(12): IN-01 return generic error from /validate/oidc instead of raw network detail The catch block previously echoed err.message (which may contain internal network addresses like ECONNREFUSED 192.168.1.50:9091) to the pre-auth caller. Log the raw message server-side only and return a generic user- facing string with no internal network detail. Co-Authored-By: Claude Sonnet 4.6 --- apps/api/src/routes/setup.ts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/apps/api/src/routes/setup.ts b/apps/api/src/routes/setup.ts index 5fb4cb9..d8bae72 100644 --- a/apps/api/src/routes/setup.ts +++ b/apps/api/src/routes/setup.ts @@ -179,10 +179,10 @@ setupRouter.post('/validate/oidc', async (c) => { } return c.json({ ok: true }, 200); } catch (err) { - return c.json({ - ok: false, - error: 'OIDC discovery failed: ' + (err instanceof Error ? err.message : String(err)), - }, 400); + // IN-01: Log raw error server-side only — do not echo internal network detail + // (e.g. "connect ECONNREFUSED 192.168.1.50:9091") to the pre-auth caller. + console.error('[setup/validate/oidc]', err instanceof Error ? err.message : String(err)); + return c.json({ ok: false, error: 'OIDC discovery failed. Check the issuer URL.' }, 400); } });