sendnrw/pocket-id
2
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2026-10-26 18:49:05 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat: improve error handling on authorize page

Browse Source
This commit is contained in:
Elias Schneider
2026-06-22 22:12:14 +02:00
parent 519cda0eef
commit 8689ddd72b
10 changed files with 111 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/specs/oidc.spec.ts
+10 -7
View File
@@ -908,10 +908,11 @@ test.describe('OIDC prompt parameter', () => {
await route.fulfill({ status: 200, body: 'attacker' });
});
const response = await page.goto(`/authorize?${urlParams.toString()}`);
await page.goto(`/authorize?${urlParams.toString()}`);
expect(response?.status()).toBe(400);
await expect(page.locator('body')).toContainText('invalid_request');
await expect(page.locator('body')).toContainText(
"The 'redirect_uri' parameter does not match any of the OAuth 2.0 Client's pre-registered redirect urls."
);
expect(attackerRedirected).toBe(false);
});
@@ -962,10 +963,12 @@ test.describe('OIDC prompt parameter', () => {
await route.fulfill({ status: 200, body: 'attacker' });
});
const response = await page.goto(`/authorize?${urlParams.toString()}`);
await page.goto(`/authorize?${urlParams.toString()}`);
await expect(page.locator('body')).toContainText(
"The 'redirect_uri' parameter does not match any of the OAuth 2.0 Client's pre-registered redirect urls."
);
expect(response?.status()).toBe(400);
await expect(page.locator('body')).toContainText('invalid_request');
expect(attackerRedirected).toBe(false);
});
@@ -1303,7 +1306,7 @@ test.describe('Pushed Authorization Requests (PAR)', () => {
expect(firstCallbackUrl.searchParams.get('code')).toBeTruthy();
await page.goto(`/authorize?${urlParams.toString()}`);
await expect(page.getByText('invalid_request_uri')).toBeVisible();
await expect(page.locator('body')).toContainText('Invalid PAR session');
});
test('PAR endpoint rejects confidential client request without client credentials', async ({