Skip to content

Implementation Advice: errors shown to the end-user #880

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
davetonge-mh wants to merge 1 commit into
base: davetonge/impl-advice/223-same-end-user
Choose a base branch
from
Open

Implementation Advice: errors shown to the end-user #880

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions FAPI_2_0_Implementation_Advice.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -298,6 +298,10 @@ Many Authorization Server implementations employ Web Application Firewalls (WAFs

NOTE: What constitutes a suspicious or malicious request may vary depending on the threat model of each Authorization Server implementation. This document intentionally avoids providing an exhaustive list of patterns to block, as such a list would quickly become outdated and might provide a false sense of security.

## Errors Shown to the End-User

When the authorization server cannot return an error response to the client, for example because the redirect URI is invalid (Section 4.1.2.1 of [@RFC6749]), it informs the end-user instead. The message should not be factually incorrect for either the end-user or the client's developer, for example by suggesting that trying again will help when the client's request was invalid. A generic message, such as "Something went wrong", may be used.

# Acknowledgements

This document was developed by the OpenID FAPI Working Group.
Expand Down
Loading