fix(auth0-express): stop leaking internal error detail from handlers - #26
Open
frederikprijck wants to merge 9 commits into
Open
fix(auth0-express): stop leaking internal error detail from handlers#26frederikprijck wants to merge 9 commits into
frederikprijck wants to merge 9 commits into
Conversation
Route handler failures through next(error) instead of echoing error.name/message/error_description to the client, so Express error middleware owns the response and internal detail is not disclosed. SECURITY: SDK-4 — verbose error messages (CWE-209).
…ailure The SDK-4 sanitization routed backchannel-logout failures through next(error), which Express turns into a 500. OIDC Back-Channel Logout §2.8 requires the RP to respond with 400 Bad Request when the logout request is invalid or the logout fails. Return 400 with an empty body on any failure — spec-compliant status, no internal error detail leaked to the caller.
…ia next() Instead of writing the 400 directly (which bypasses Express error middleware and loses server-side observability), forward a new Error carrying status: 400 through next(). Express's default handler emits the spec-mandated 400 (OIDC Back-Channel Logout §2.8) from err.status, the app's error middleware can log it, and the original error is preserved on cause without leaking to the client.
frederikprijck
marked this pull request as draft
August 25, 2026 10:04
…estError Introduce GenericRequestError<TError>, an HTTP-status-bearing error for forwarding to Express via next(). Express's default handler reads err.status, so it yields the OIDC-mandated 400 (Back-Channel Logout §2.8) with no custom handler, and omits err.message from the client response in production. The original failure is preserved on cause for app error middleware to log or branch on. Avoids a name clash with auth0-server-js's BackchannelLogoutError and keeps the wrapper reusable for other handlers.
…f next() The back-channel logout endpoint is called server-to-server by the OP, so it should not flow through the app's Express error middleware (which is meant for its browser-facing auth routes and would otherwise return a config-dependent HTML page to Auth0). The handler now owns its response: bare 400 on failure per OIDC Back-Channel Logout §2.8, 204 on success, with no internal detail leaked. This drops GenericRequestError (introduced earlier in this branch and unused now), so the app's global error handler only ever receives the real SDK error instance, top-level, from the browser-facing handlers. README updated to document the split and how to log backchannel failures via a custom route.
frederikprijck
marked this pull request as ready for review
August 25, 2026 11:38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The auth handlers echoed
error.name/error.message(anderror.cause.error_description) verbatim in HTTP responses, leaking internal/library error detail useful for probing the auth flow.Changes
The three browser-facing handlers (login, callback, logout) now route failures through Express's
next(error)instead of writing error detail to the response. Express's error middleware owns the response; the SDK no longer authors the leak. Their signatures gained anextparam, threaded through the router.The back-channel logout handler is called server-to-server by the OP and must return a spec-shaped response (OIDC Back-Channel Logout 1.0 §2.8:
200/204on success,400on failure), so it keeps owning its own response rather than delegating tonext(). The SDK-4 change there is dropping the leakederror.messagefrom the bare400body.Tests
Handler + index specs updated to the sanitized contract. The error-leak tests run under
NODE_ENV=production(matching Express's real sanitization behavior) and were verified via a leak-revert to genuinely fail if a handler leaks. auth0-express suite: 185/185 pass.