Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OidcBackChannelLogoutWebFilter error response is not a correct JSON #16072

Open
katya-tis opened this issue Nov 12, 2024 · 0 comments
Open

OidcBackChannelLogoutWebFilter error response is not a correct JSON #16072

katya-tis opened this issue Nov 12, 2024 · 0 comments
Assignees
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) status: waiting-for-triage An issue we've not yet triaged type: bug A general bug

Comments

@katya-tis
Copy link

Describe the bug
When OidcBackChannelLogoutWebFilter returns an error from handleAuthenticationFailure(...) method:

  • the response content type is not set to "application/json";
  • error_uri is missing closing quotes;
  • the text for at least the description should be escaped for special characters.

To Reproduce
Call the oidc back channel logout endpoint without a logout token for example. The response is:

{
	"error_code": "invalid_request",
	"error_description": "An error occurred while attempting to decode the Jwt: Cannot invoke "String.indexOf(String)" because "s" is null",
	"error_uri: "https://openid.net/specs/openid-connect-backchannel-1_0.html#Validation"
}

Expected behavior
The expected response should look like this:

{
    "error_code": "invalid_request",
    "error_description": "An error occurred while attempting to decode the Jwt: Cannot invoke \"String.indexOf(String)\" because \"s\" is null",
    "error_uri": "https://openid.net/specs/openid-connect-backchannel-1_0.html#Validation"
}
@katya-tis katya-tis added status: waiting-for-triage An issue we've not yet triaged type: bug A general bug labels Nov 12, 2024
@sjohnr sjohnr added the in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) label Nov 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) status: waiting-for-triage An issue we've not yet triaged type: bug A general bug
Projects
None yet
Development

No branches or pull requests

3 participants