luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(12): IN-01 return generic error from /validate/oidc instead of raw network detail

Browse Source 
The catch block previously echoed err.message (which may contain internal
network addresses like ECONNREFUSED 192.168.1.50:9091) to the pre-auth
caller. Log the raw message server-side only and return a generic user-
facing string with no internal network detail.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Lucas Berger
2026-06-15 16:18:10 -04:00
co-authored by Claude Sonnet 4.6
parent 7a512a9726
commit d9dfe72aab
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/routes/setup.ts
+4 -4
View File
@@ -179,10 +179,10 @@ setupRouter.post('/validate/oidc', async (c) => {
} }
return c.json({ ok: true }, 200); return c.json({ ok: true }, 200);
} catch (err) { } catch (err) {
return c.json({ // IN-01: Log raw error server-side only — do not echo internal network detail
ok: false, // (e.g. "connect ECONNREFUSED 192.168.1.50:9091") to the pre-auth caller.
error: 'OIDC discovery failed: ' + (err instanceof Error ? err.message : String(err)), console.error('[setup/validate/oidc]', err instanceof Error ? err.message : String(err));
}, 400); return c.json({ ok: false, error: 'OIDC discovery failed. Check the issuer URL.' }, 400);
} }
}); });