Skip to content

Commit 46b7eb0

Browse files
committed
fix: Remove error details from HTML response in OAuth callback
Return generic error message to prevent information leakage. Detailed error is logged server-side for debugging.
1 parent 9052e3d commit 46b7eb0

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

components/backend/handlers/oauth.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -311,8 +311,9 @@ func HandleOAuth2Callback(c *gin.Context) {
311311
// Handle cluster-level Google OAuth
312312
if err := HandleGoogleOAuthCallback(c.Request.Context(), code, stateMap); err != nil {
313313
log.Printf("Cluster-level OAuth failed: %v", err)
314+
// Return generic error to client, details logged server-side only
314315
c.Data(http.StatusOK, "text/html; charset=utf-8", []byte(
315-
"<html><body><h1>Authorization Error</h1><p>Provider: "+provider+"</p><p><strong>Error:</strong> "+err.Error()+"</p><p>You can close this window.</p><script>window.close();</script></body></html>",
316+
"<html><body><h1>Authorization Error</h1><p>Failed to connect Google Drive. Please try again.</p><p>You can close this window.</p><script>window.close();</script></body></html>",
316317
))
317318
return
318319
}

0 commit comments

Comments
 (0)