Backport: no response-body reflection in API errors (#4421) - #4427
Open
stevenvegt wants to merge 2 commits into
Open
Backport: no response-body reflection in API errors (#4421)#4427stevenvegt wants to merge 2 commits into
stevenvegt wants to merge 2 commits into
Conversation
) * fix(auth): never reflect fetched response bodies in API responses Several callback handlers formatted err.Error() (or a raw response body) into the OAuth2 error_description or RFC7807 detail returned to the caller. This can be used in an attack chain to disclose internal response data. This PR fixes that by not including the error in the response body but instead log it in truncated form to the debug logs. Assisted-by: AI
stevenvegt
requested review from
gerardsn,
reinkrul and
woutslakhorst
as code owners
July 27, 2026 15:44
Contributor
3 new issues
|
Contributor
|
Coverage Impact This PR will not change total coverage. Modified Files with Diff Coverage (6)
🤖 Increase coverage with AI coding...🚦 See full report on Qlty Cloud » 🛟 Help
|
Dirklectisch
approved these changes
Jul 28, 2026
stevenvegt
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Backport of #4421 (never reflect fetched response bodies in API responses) to V6.2.
Handlers that make an outbound request now return a static error description and pass the underlying error as the internal (logged, never serialized) error. Fetched content that is useful for debugging is debug-logged truncated via the new
core.TruncateHTTPBodyinstead of being placed in a returned error. Covers the OpenID4VCI and OpenID4VP callback handlers, the token client's unparseable-response error, the did:web resolver's parse error, and the Discovery Service client.Conflict resolution notes
Everything applied cleanly except
auth/api/iam/openid4vci.goand its test: master'shandleOpenID4VCICallbackgained the OpenID4VCI 1.0 nonce-endpoint machinery after V6.2 branched, so the reflection fixes were applied by hand onto the V6.2 shape of the handler. Same pattern, same wording where the sites correspond (access token fetch, credential fetch, credential parse with truncated debug log, credential verify). The V6.2-only proof-building error was given the same treatment (static description, cause moved to the internal error). The nonce-endpoint sites from master do not exist on V6.2. Test assertions were adapted the same way, including the sentinel test that the unparseable credential body is not reflected in the OAuth2 error description.The release notes conflict was resolved by adding an
Unreleasedsection with only the #4421 bullet; it will combine trivially with #4424 when both merge.Not applicable to V5.4: none of the affected modules (
auth/api/iam,auth/client/iam,discovery,vdr/didweb) exist there, and the V5.4 auth v1 client already only logs response bodies (clipped) without reflecting them.Testing
go build ./...passes;go testonauth/...,core/...,discovery/...andvdr/didwebis green on this branch.