Error message reflection in /login?error=...

Open Beginner friendly
#184 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
typescript

Research direction

Start in route.ts at lines 80 and 124, where the rate-limit and OAuth errors are reflected into the redirect URL. Trace the /login?error=... flow, then add or update tests so URLs contain only the canonical codes and document those codes as part of the acceptance criteria.

Written by the indexing model from the issue text.

Description

P2-medium security

Summary

Raw rateLimitResult.error and oauthError.message are reflected into redirect URLs.

Source

P2 follow-up from /ship adversarial review of PR #176 (silent GitHub token refresh).

Details

route.ts:80,124 reflect rateLimitResult.error and oauthError.message via encodeURIComponent to a redirect URL.

Fix

Emit fixed error codes only (rate_limited, oauth_failed); keep messages in server logs / Sentry.

Acceptance

  • No raw error messages in /login?error=...
  • Stable error codes documented
  • Tests assert only canonical codes appear in URLs
Dominant language
TypeScript
Stars
5
Forks
2
Avg merge
6h 9m
Merged PRs (30d)
2

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from laststance/gitbox

All issues in laststance/gitbox

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.