🛡️ Sentinel: [MEDIUM] Fix error observability for OAuth callback responses#260
🛡️ Sentinel: [MEDIUM] Fix error observability for OAuth callback responses#260davidruzicka wants to merge 1 commit into
Conversation
…on IDs to OAuth provider callback 500 responses Following the security principles from `.jules/sentinel.md`, 500 error responses exposed to clients should always include a uniquely generated Correlation ID. The previous logic returned a generic 500 error string without trace ability in `handleCallback` inside `src/auth/oauth-provider.ts`. This commit updates it to safely incorporate and log a new \`correlationId\` for operational observability and preventing silent errors from escaping unlinked to logs. Test expectations were updated accordingly to reflect the modified output containing \`correlation ID: <UUID>\`. Co-authored-by: davidruzicka <14172985+davidruzicka@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
1 participant
🚨 Severity: MEDIUM
💡 Vulnerability: Potential un-traced server-side error and lack of observability via the OAuth callback flow response for clients. The application returned generic 500 error messages without tying them back to internal log events via correlation ID.
🎯 Impact: Inability to properly trace generic errors client-side back to specific, detailed internal logs. This breaks standard troubleshooting and debugging observability principles established for this application framework.
🔧 Fix: Used
generateCorrelationId()in the callback exception handler ofExternalOAuthProvider, logged theerrobject alongside thecorrelationId, and securely appended the correlation ID to the safe, generic internal server error client response.✅ Verification: Ran
npm run testwhich succeeded, executing the updated coverage for correlation ID error handling tests.PR created automatically by Jules for task 3620838790017427947 started by @davidruzicka