Repository navigation
Stop the sign-in error page from showing text from the URL #411
Description
Summary
The auth error page prints error_description from the URL as-is. Anyone can send a link like https://docs.plus/?error=x&error_code=y&error_description=<text> and the victim sees that text in a red alert box on the real domain. React escapes it, so this is content spoofing, not XSS.
- Severity: Low (informational)
- Area:
apps/webapp - Source: security review of 2026-10-06
Where
apps/webapp/src/proxy.ts:18-24forwards any?error=&error_code=request with itserror_descriptionto the error page.apps/webapp/src/pages/auth/error.tsx:11,36renders the text.- A direct
/auth/error?error_description=…link works too, without the proxy.
Fix plan
- In
apps/webapp/src/pages/auth/error.tsx, map known Supabaseerror_codevalues to fixed copy, for exampleotp_expired→ "This sign-in link has expired. Request a new one." andaccess_denied→ "Sign-in was cancelled." - For an unknown code, show one generic message. Never render
error_description. - Optionally log the raw code and description to the console or Sentry for debugging.
- Copy goes through the
tech-writerskill (Simplified English).
Acceptance criteria
-
/auth/error?error_description=Your%20account%20is%20lockedshows no attacker text. - An expired magic link still shows a clear, correct message.
Generated by Claude Code
Activity
docs: record the security and push fixes in changelogs and agent docs
[-]The sign-in error page shows attacker-written text from the URL[/-][+]Stop the sign-in error page from showing text from the URL[/+]HMarzban commentedon Oct 6, 2026
Status: fixed in
c6fdc2donclaude/youthful-lovelace-3nvsc6. Not merged or deployed yet.What shipped:
apps/webapp/src/pages/auth/error.tsxnever renders text from the URL. Forotp_expiredit shows "This sign-in link has expired or was already used. Request a new link and try again." Every other code shows "Sign-in did not finish. Try again, or contact support if it keeps failing."apps/webapp/src/proxy.tsnow forwardserror_codeinstead oferror_description. The page needs the code to choose the expired-link message. The fix plan did not list this file.Needs a maintainer decision: root
CLAUDE.md§Settled (Next product APIs) says "Do not editsrc/proxy.ts". The commit changes only the auth-error branch, and its message says approval is pending. If the edit is refused, revert only theproxy.tspart. The page then shows the general message for every error, so acceptance criterion 2 fails.Differences from the plan:
access_denied. It gets the general message.Check after deploy:
/auth/error?error_description=Your%20account%20is%20lockedshows only fixed copy. An expired magic link shows the expired-link message.Generated by Claude Code
chore(merge): land the security and push fixes branch
fix: close follow-ups from the security and push review
refactor(webapp): route docTitle through the provider and trim push code
fix(webapp): harden chat avatars, pasted nodes and new slugs