fix: return 500 internal server errors on miss configuration during token exchange

shepilov · shepilov · commit 1cfe7b344792 · 2026-04-08T15:15:28.000+02:00
diff --git a/web/auth/token_exchange.go b/web/auth/token_exchange.go
@@ -88,7 +88,8 @@ func validateTokenExchangeIDToken(inst *instance.Instance, raw string) (jwt.MapC
 
 	expectedIssuer, err := oidcprovider.GetIssuer(inst.ContextName, conf)
 	if err != nil {
-		return nil, errors.New("invalid token")
+		inst.Logger().WithNamespace("token_exchange").Errorf("Cannot get OIDC issuer for context %s: %s", inst.ContextName, err)
+		return nil, echo.NewHTTPError(http.StatusInternalServerError, "internal server error")
 	}
 	issuer, err := claims.GetIssuer()
 	if err != nil || issuer == "" || issuer != expectedIssuer {

Original file line number	Diff line number	Diff line change
`@@ -88,7 +88,8 @@ func validateTokenExchangeIDToken(inst *instance.Instance, raw string) (jwt.MapC`
`88`	`88`
`89`	`89`	`expectedIssuer, err := oidcprovider.GetIssuer(inst.ContextName, conf)`
`90`	`90`	`if err != nil {`
`91`		`- return nil, errors.New("invalid token")`
	`91`	`+ inst.Logger().WithNamespace("token_exchange").Errorf("Cannot get OIDC issuer for context %s: %s", inst.ContextName, err)`
	`92`	`+ return nil, echo.NewHTTPError(http.StatusInternalServerError, "internal server error")`
`92`	`93`	`}`
`93`	`94`	`issuer, err := claims.GetIssuer()`
`94`	`95`	`if err != nil \|\| issuer == "" \|\| issuer != expectedIssuer {`