Function TestOAuth2InformationDisclosure

coderd/oauth2_security_test.go:314–394

TestOAuth2InformationDisclosure tests that error messages don't leak sensitive information

(t *testing.T)

// TestOAuth2InformationDisclosure tests that error messages don't leak sensitive information
func TestOAuth2InformationDisclosure(t *testing.T) {
	t.Parallel()

	client := coderdtest.New(t, nil)
	_ = coderdtest.CreateFirstUser(t, client)

	ctx := t.Context()

	// Register a client for testing
	clientName := fmt.Sprintf("test-client-%d", time.Now().UnixNano())
	regReq := codersdk.OAuth2ClientRegistrationRequest{
		RedirectURIs: []string{"https://example.com/callback"},
		ClientName:   clientName,
	}
	regResp, err := client.PostOAuth2ClientRegistration(ctx, regReq)
	require.NoError(t, err)

	t.Run("ErrorsDoNotLeakClientSecrets", func(t *testing.T) {
		t.Parallel()
		ctx := t.Context()

		// Try various invalid operations and ensure they don't leak the client secret
		_, err := client.GetOAuth2ClientConfiguration(ctx, regResp.ClientID, "invalid-token")
		require.Error(t, err)

		var httpErr *codersdk.Error
		require.ErrorAs(t, err, &httpErr)

		// Error message should not contain any part of the client secret or registration token
		errorText := strings.ToLower(httpErr.Message + httpErr.Detail)
		require.NotContains(t, errorText, strings.ToLower(regResp.ClientSecret))
		require.NotContains(t, errorText, strings.ToLower(regResp.RegistrationAccessToken))
	})

	t.Run("ErrorsDoNotLeakDatabaseDetails", func(t *testing.T) {
		t.Parallel()
		ctx := t.Context()

		// Try to access non-existent client
		_, err := client.GetOAuth2ClientConfiguration(ctx, "non-existent-client-id", regResp.RegistrationAccessToken)
		require.Error(t, err)

		var httpErr *codersdk.Error
		require.ErrorAs(t, err, &httpErr)

		// Error message should not leak database schema information
		errorText := strings.ToLower(httpErr.Message + httpErr.Detail)
		require.NotContains(t, errorText, "sql")
		require.NotContains(t, errorText, "database")
		require.NotContains(t, errorText, "table")
		require.NotContains(t, errorText, "row")
		require.NotContains(t, errorText, "constraint")
	})

	t.Run("ErrorsAreConsistentForInvalidClients", func(t *testing.T) {
		t.Parallel()
		ctx := t.Context()