Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Error handling for missing and invalid request objects

Description

Currently the error events related to request objects are handled locally (within error.vm). This is caused by the fact that request object processing is performed before redirect_uri validation and thus OP doesn’t yet have a validated destination for the error messages.

For instance the PAR spec (section 4) requires that such error message would still be sent back to the client.

Environment

None

Activity

Henri MikkonenJune 21, 2024 at 11:21 AM

  • Add flag for request object validation failures in OIDCAuthenticationResponseContext

    • If the flag is set, then authorize-flow calls ValidateRedirectURI before handling the error event

  • Updated flow tests accordingly

Completed

Details

Assignee

Reporter

Components

Fix versions

Created June 21, 2024 at 8:08 AM
Updated October 21, 2024 at 4:34 PM
Resolved October 21, 2024 at 4:34 PM