Repository navigation
Handle sign-in failures with error page instead of retry loop - #263
Merged
Merged
Conversation
…ovider:0.18.3, auth-ui:0.21.6, openapi-operations:0.4.6, auth-resource-server-codegen-templates:0.0.166, auth-server-sdk:0.33.5, trpc-backend-init:0.9.87, auth-server:0.56.1, e2e-auth-tests:0.12.13 - send failed sign-ins to /auth/error instead of looping through the login flow When the token endpoint refused the authorization code exchange (e.g. `invalid_target`: the client app is not connected to its default audience's API server), the generated /auth/authorize page redirected to `successful_logout_redirect_uri`. On apps whose `/` leads back to /auth/login (the registry), the auth server's live session minted a new code at once and the browser bounced between /auth/login and /auth/authorize forever. - auth-client-sdk: token endpoint refusals that keep the session throw `TokenEndpointRequestFailedError` (oauth_error, error_description, status); `resolveLoginErrorPage()` maps a failed sign-in to an error page entry (walks the cause chain). - auth-common: `app_not_connected_to_api_server` and `login_failure` error catalog entries. - auth-react-provider: the authorize hook sends every failed exchange to the app's error page, redeems each code once per page load (effect re-runs await the first exchange) and returns early when the app already has a session; the login hook shows the error page when a signed-in user's default access tokens cannot be acquired. - e2e: DefaultAudienceNotConnected.cy.ts pins the error page. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VkeBhNN2Cv7oosBKvfXJXb
… in DefaultAudienceNotConnected create_and_login_as_superuser() asserts that nobody is signed in, but the spec ends signed in to the auth server as its own user and test isolation does not clear cookies before `after` hooks, so the reconnect hook failed and left the example app disconnected for the rest of the shard. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VkeBhNN2Cv7oosBKvfXJXb
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When a client app's authorization code exchange fails at the token endpoint (e.g., the app is not connected to its default audience's API server), redirect the user to the error page instead of back into the login flow. This prevents infinite bouncing between login and authorize pages when the auth server session is still valid.
Key Changes
TokenEndpointRequestFailedErrorexception class that carries RFC 6749 §5.2 error codes (oauth_error), descriptions, HTTP status, and session state from token endpoint responsesresolveLoginErrorPage()function that maps sign-in failures to appropriate error page entries:invalid_target(app not connected to API server) →app_not_connected_to_api_server(403)login_failurewith original HTTP status or 500causechains to find the underlying token endpoint failureuseTradeAuthorizationCodeForTokensEffect()anduseStartLoginOauthPKCEFlow()to redirect to error pages on sign-in failuresapp_not_connected_to_api_serverandlogin_failureerror IDs to the common error message catalogDefaultAudienceNotConnected.cy.ts) verifying the error page flow when an app is disconnected from its default audienceImplementation Details
TokenEndpointRequestFailedErrorpreserves the original error message format for backward compatibility while exposing structured OAuth error detailsInvalidAuthorizeCallbackErrorhttps://claude.ai/code/session_01VkeBhNN2Cv7oosBKvfXJXb