server: redact client secret from authentication error messages

The allowRelyingParty function included the plaintext client secret
in the error message on authentication failure. This leaks credentials
into server logs, which may be aggregated into centralised logging
systems.

Replace the secret with only the client ID, which is sufficient for
debugging authentication failures.

Signed-off-by: Piers Dawson-Damer <piers@groupthink.asia>

Author: piersdd

server/token.go

@@ -920,7 +920,7 @@ func (ar *AuthRequest) allowRelyingParty(r *http.Request) (int, error) {
 		return http.StatusBadRequest, fmt.Errorf("tsidp: client_id mismatch")
 	}
 	if clientSecretcmp != 1 {
-		return http.StatusUnauthorized, fmt.Errorf("tsidp: invalid client secret: [%s] [%s]", clientID, clientSecret)
+		return http.StatusUnauthorized, fmt.Errorf("tsidp: invalid client secret for client %q", clientID)
 	}
 	return http.StatusOK, nil
 }