feat: error_hint and error_debug are now exposed through error_description by mitar · Pull Request #460 · ory/fosite

mitar · 2020-08-13T03:54:49Z

Related issue

Fixes #456.

Proposed changes

When error_description is send out, it includes now error_hint (if present) and error_debug (if present and enabled to be send). Because error_description is standard this allows easier access to that information.

error_hint and error_debug fields are left as-is for backwards compatibility purposes. error_verbose is added to provide only the old error description.

Checklist

I have read the contributing guidelines
I have read the security policy
I confirm that this pull request does not address a security
vulnerability. If this pull request addresses a security vulnerability, I
confirm that I got green light (please contact
security@ory.sh) from the maintainers to push
the changes.
I have added tests that prove my fix is effective or that my feature works
I have added necessary documentation within the code base (if appropriate)

…ption

access_error.go

mitar · 2020-08-22T00:42:00Z

Closing and reopening to trigger tests to run.

aeneasr

Great work! I think this will appear in a couple of other places as well (introspection?). I also had the idea that we could improve all of this a bit more by making RFCError a JSONUnmarshaller and add a method AsQueryString() string which would do the modifications instead of handling this. The only problem would be that f.SendDebugMessagesToClients would need to be passed to these functions somehow.

access_error.go

authorize_error.go

access_error.go

aeneasr · 2020-08-29T07:49:43Z

Once again, sorry for the late review! By the way, if you allow edits from maintainers I should be able to synch the branches and make the nancy failure go away :)

mitar · 2020-08-29T07:52:19Z

By the way, if you allow edits from maintainers I should be able to synch the branches and make the nancy failure go away

It should already be on.

aeneasr · 2020-08-29T07:52:37Z

Yes, my bad, I had to change something in the repository settings!

mitar · 2020-08-29T07:57:00Z

About JSONUnmarshaller, yea, I have no idea how to pass this, unless we do something like:

if !config.SendDebugMessagesToClients {
   error = error.WithDebug("")
}

And then leave to JSONUnmarshaller to serialize.

mitar · 2020-08-29T08:01:28Z

Or maybe we make Sanitize method on the error, which does the above, accepting boolean if it should sanitize or not. And then you call error.Sanitize(!config.SendDebugMessagesToClients) or something.

aeneasr · 2020-08-29T11:39:15Z

Hm yeah in that case it probably makes sense to just keep it as is!

aeneasr · 2020-08-31T20:52:59Z

Just to double-check, this would now be good for merge right?

mitar · 2020-08-31T21:21:27Z

No, I have not yet updated it based on your comments. My plan is:

Make descriptions multi line (I am personally not too sure about it, but if you like it, sure).
Make ErrorToRFC6749Error return by value, not ref.
Implement JSONUnmarshaller and AsQueryString.
Add Sanitize.

aeneasr · 2020-08-31T21:30:17Z

Ok sounds good :)

errors.go

mitar · 2020-09-05T05:29:37Z

introspect.go


 func (f *Fosite) IntrospectToken(ctx context.Context, token string, tokenType TokenType, session Session, scopes ...string) (TokenType, AccessRequester, error) {
-	var found bool = false
+	var found = false


This is not necessary.

mitar · 2020-09-05T05:29:49Z

introspect.go

+		} else if err.Error() == ErrUnknownRequest.Error() || errors.Cause(err).Error() == ErrUnknownRequest.Error() {
 			// Nothing to do
-		} else if err != nil {
+		} else {


This condition was unnecessary and always true.

mitar · 2020-09-05T05:31:08Z

introspect.go

 	for _, validator := range f.TokenIntrospectionHandlers {
 		tt, err := validator.IntrospectToken(ctx, token, tokenType, ar, scopes)
-		if err := errors.Cause(err); err == nil {
+		if err == nil {


I simplified the logic here a bit. ErrorToRFC6749Error uses Cause internally as well, so I think this now is clearer and easier to read.

mitar · 2020-09-05T05:32:56Z

@aeneasr I finished things from my side. Please review again. When merging, please squash commits. (Or do you want me to squash them?)

aeneasr · 2020-09-07T13:07:15Z

All good, I'll squash them :)

access_error.go

authorize_error.go

errors.go

introspect.go

mitar · 2020-09-08T18:36:35Z

Please see my comments above and tell me your final decisions so that I know what to do.

aeneasr

Thank you, almost there :) Still on vacation until September 23rd so response times might be a bit longer!

access_error.go

authorize_error.go

errors.go

mitar · 2020-09-15T18:53:02Z

I updated the PR.

Enjoy vacations, no hurry with this one.

aeneasr

Nice! :)

nerocrux · 2020-09-24T03:38:23Z

@mitar @aeneasr
Thank you for your work!
It's not important but I wonder if it is possible to provide an option for removing error_verbose from the error response because the message in error_verbose and error_description feels duplicated for me.

mitar · 2020-09-24T05:12:32Z

I would suggest we simply make UnmarshalJSON always return an error and remove error_verbose altogether. So error_verbose is there just to support UnmarshalJSON, but UnmarshalJSON is not really needed/used at all in this codebase. I implemented it just for completeness.

mitar · 2020-09-24T05:31:12Z

Also, how people feel about removing error_hint and error_debug? Or should we just maybe mark them in a comment as 'deprecated pending future removal" and then remove them in half a year or so?

nerocrux · 2020-09-24T08:24:53Z

@mitar
Thank you for your reply.

I would suggest we simply make UnmarshalJSON always return an error and remove error_verbose altogether.

I agree with you.

how people feel about removing error_hint and error_debug?

I'm a user of fosite (not hydra) so my opinion's maybe not complete but I'm totally OK with removing error_hint and error_debug (merging them into error_description).

lazeratops · 2020-09-24T10:16:30Z

Came here to ask about the same thing - error_verbose seems redundant. If error_hint and error_debug are already merged into error_description I am fine removing them (as a caveat also just a fosite user, not hydra, not sure exactly how it would affect hydra users). To clarify for sanity purposes, to ensure I am seeing intended behaviour: the only one of these fields that is not intended to be exposed back to the client by default is error_debug, correct?

aeneasr · 2020-09-24T14:19:40Z

Those fields will be eventually deprecated. In the meanwhile, simply ignore them!

lazeratops · 2020-09-24T14:33:29Z

We can definitely ask the client to ignore them; the main reason I was asking is to confirm that our auth service is not leaking any info that it shouldn't and is up to spec with the RFC. When we run WriteAuthorizeError() via the fosite provider, the response fosite produces to send back to the client does include those error_verbose fields and error hints in its current state. I wanted to confirm that we are not meant to be sanitizing any of this away (except for the debug info, which is already sanitized by fosite)

mitar · 2020-09-24T14:40:30Z

Yes, those are fine. There is no extra information provided with these new fields, just merging them into error_description.

nerocrux · 2020-09-26T13:44:45Z

Thanks. I'm OK with this. But please allow me to confirm:

There is no way to remove error_verbose from error response (e.g. token endpoint) and the decision is we don't remove it for now.
Do you have any plan on the deprecation of these fields?

Thank you.

aeneasr · 2020-09-28T09:50:24Z

Yes, these will be deprecated in the upcoming release!

aeneasr · 2020-11-12T10:41:18Z

For anyone following this thread - I had to introduce some changes to this original PR. You can find the changeset here: e463674

feat: error_hint and error_debug are now exposed through error_descri…

c5cfc4d

…ption

mitar mentioned this pull request Aug 13, 2020

Make error_hint be part of error_description #456

Closed

mitar commented Aug 16, 2020

View reviewed changes

access_error.go Outdated Show resolved Hide resolved

mitar commented Aug 16, 2020

View reviewed changes

access_error.go Outdated Show resolved Hide resolved

mitar closed this Aug 22, 2020

mitar reopened this Aug 22, 2020

aeneasr reviewed Aug 29, 2020

View reviewed changes

access_error.go Outdated Show resolved Hide resolved

access_error.go Outdated Show resolved Hide resolved

authorize_error.go Outdated Show resolved Hide resolved

access_error.go Outdated Show resolved Hide resolved

aeneasr added breaking change Changes behavior in a breaking manner. feat New feature or request. labels Aug 29, 2020

aeneasr self-assigned this Aug 29, 2020

Merge branch 'master' into error-hints

fa7a32f

mitar changed the title ~~feat: error_hint and error_debug are now exposed through error_description~~ WiP: feat: error_hint and error_debug are now exposed through error_description Aug 31, 2020

mitar marked this pull request as draft August 31, 2020 21:21

mitar changed the title ~~WiP: feat: error_hint and error_debug are now exposed through error_description~~ feat: error_hint and error_debug are now exposed through error_description Aug 31, 2020

mitar added 5 commits September 4, 2020 10:43

Merge branch 'master' into error-hints

be28003

Merge branch 'error-hints' of github.com:mitar/fosite into error-hints

387a34c

New version

26e6c11

Style

8b11aad

Fixing tests

98a3a4c

mitar marked this pull request as ready for review September 5, 2020 05:19

mitar commented Sep 5, 2020

View reviewed changes

errors.go Show resolved Hide resolved

mitar commented Sep 5, 2020

View reviewed changes

mitar requested a review from aeneasr September 5, 2020 05:33

aeneasr reviewed Sep 7, 2020

View reviewed changes

access_error.go Outdated Show resolved Hide resolved

authorize_error.go Show resolved Hide resolved

errors.go Show resolved Hide resolved

errors.go Show resolved Hide resolved

introspect.go Outdated Show resolved Hide resolved

aeneasr reviewed Sep 15, 2020

View reviewed changes

mitar added 4 commits September 15, 2020 11:11

Merge branch 'master' into error-hints

5a2a90e

Simple JSON.

026ba1d

Better escaping.

6894f65

Use errors.Is.

0d6e539

aeneasr approved these changes Sep 16, 2020

View reviewed changes

aeneasr merged commit 8daab21 into ory:master Sep 16, 2020

mitar deleted the error-hints branch September 16, 2020 18:00

mitar mentioned this pull request Sep 20, 2020

fix: Full JSON escaping #481

Merged

5 tasks

Comments

Conversation

mitar commented Aug 13, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related issue

Proposed changes

Checklist

Uh oh!

Uh oh!

Uh oh!

mitar commented Aug 22, 2020

Uh oh!

aeneasr left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aeneasr commented Aug 29, 2020

Uh oh!

mitar commented Aug 29, 2020

Uh oh!

aeneasr commented Aug 29, 2020

Uh oh!

mitar commented Aug 29, 2020

Uh oh!

mitar commented Aug 29, 2020

Uh oh!

aeneasr commented Aug 29, 2020

Uh oh!

aeneasr commented Aug 31, 2020

Uh oh!

mitar commented Aug 31, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aeneasr commented Aug 31, 2020

Uh oh!

Uh oh!

mitar Sep 5, 2020

Choose a reason for hiding this comment

Uh oh!

mitar Sep 5, 2020

Choose a reason for hiding this comment

Uh oh!

mitar Sep 5, 2020

Choose a reason for hiding this comment

Uh oh!

mitar commented Sep 5, 2020

Uh oh!

aeneasr commented Sep 7, 2020

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mitar commented Sep 8, 2020

Uh oh!

aeneasr left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mitar commented Sep 15, 2020

Uh oh!

aeneasr left a comment

Choose a reason for hiding this comment

Uh oh!

nerocrux commented Sep 24, 2020

Uh oh!

mitar commented Sep 24, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mitar commented Aug 13, 2020 •

edited

Loading

aeneasr left a comment •

edited

Loading

mitar commented Aug 31, 2020 •

edited

Loading

mitar commented Sep 24, 2020 •

edited

Loading