fix: handle missing OIDC auth request gracefully#74
Merged
mattdjenkinson merged 3 commits intomainfrom Apr 20, 2026
Merged
Conversation
The GET /login route called getAuthRequest() without error handling. When a request arrived with an expired or invalid authRequest ID, the Zitadel OIDC service returned a NOT_FOUND gRPC error that propagated as an unhandled ConnectError, crashing the route handler with a 500. Wrap the call in try/catch and add a null guard, returning a 400 JSON response instead. This matches the existing pattern used by the SAML branch which already checks for a missing samlRequest. Made-with: Cursor
mattdjenkinson
requested review from
a team,
felixwidjaja,
kevwilliams,
scotwells,
yahyafakhroji and
zachsmith1
and removed request for
a team
scotwells
reviewed
Apr 16, 2026
|
|
||
| if (!authRequest) { | ||
| return NextResponse.json( | ||
| { error: "Auth request not found" }, |
There was a problem hiding this comment.
Is this the error end users would end up seeing?
Collaborator
Author
There was a problem hiding this comment.
Yeah - i've pushed another commit that improves the error messaging.
Previously, when the /login route encountered errors (expired auth
request, missing SAML request, unreachable IDP, no request params),
it returned raw JSON like {"error":"Auth request not found or expired"}
directly to the browser. Since this route is reached via browser
navigation (not a fetch() call), users saw unhelpful raw JSON text.
Replace all user-facing NextResponse.json() error responses with
redirects to a new /error page that renders inside the existing boxed
card layout with a clear title and actionable message.
The catch block for getAuthRequest now inspects the ConnectError code
from Zitadel to provide specific guidance: expired sessions (NOT_FOUND),
permission issues, service unavailability, and timeouts each get a
tailored message.
The two JSON responses intentionally left unchanged:
- RSC check: internal Next.js safeguard, never user-facing
- Prompt.NONE: OIDC spec requires no UI for silent auth; the calling
application handles this programmatically
Made-with: Cursor
mattdjenkinson
had a problem deploying
to
staging
GitHub Actions
Failure
scotwells
previously approved these changes
Apr 16, 2026
mattdjenkinson
had a problem deploying
to
staging
GitHub Actions
Failure
mattdjenkinson
had a problem deploying
to
staging
GitHub Actions
Failure
mattdjenkinson
had a problem deploying
to
staging
GitHub Actions
Failure
kevwilliams
previously approved these changes
Apr 17, 2026
ConnectError is only re-exported as a type from @zitadel/client
(export type { ConnectError }), so it cannot be used with instanceof
at runtime. Check for the error shape via property inspection instead.
Made-with: Cursor
mattdjenkinson
dismissed stale reviews from kevwilliams and scotwells
via
1c33724
JoseSzycho
approved these changes
Apr 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The GET /login route called getAuthRequest() without error handling. When a request arrived with an expired or invalid authRequest ID, the Zitadel OIDC service returned a NOT_FOUND gRPC error that propagated as an unhandled ConnectError, crashing the route handler with a 500.
Wrap the call in try/catch and add a null guard, returning a 400 JSON response instead. This matches the existing pattern used by the SAML branch which already checks for a missing samlRequest.
Fixes: https://sentry.prod.env.datum.net/organizations/sentry/issues/2054/?alert_rule_id=19&alert_type=issue¬ification_uuid=852b3420-6a90-49e9-8246-540ffe41b7d2&project=6&referrer=slack