fix: conceal sensitive domain information in auth error messages

Claude AI · Claude AI · commit ff34fccfda91 · 2025-03-27T12:18:26.000Z
Remove exposure of allowed domain list in OIDC authentication error messages to enhance security. Third-party contractors no longer see internal domain lists when accessing Coder with unauthorized email addresses.
diff --git a/coderd/userauth.go b/coderd/userauth.go
@@ -1358,7 +1358,7 @@ func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {
 		emailSp := strings.Split(email, "@")
 		if len(emailSp) == 1 {
 			httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
-				Message: fmt.Sprintf("Your email %q is not in domains %q!", email, api.OIDCConfig.EmailDomain),
+				Message: fmt.Sprintf("Your email %q is not from an authorized domain! Please contact your administrator.", email),
 			})
 			return
 		}
@@ -1373,7 +1373,7 @@ func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {
 		}
 		if !ok {
 			httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
-				Message: fmt.Sprintf("Your email %q is not in domains %q!", email, api.OIDCConfig.EmailDomain),
+				Message: fmt.Sprintf("Your email %q is not from an authorized domain! Please contact your administrator.", email),
 			})
 			return
 		}

Original file line number	Diff line number	Diff line change
`@@ -1358,7 +1358,7 @@ func (api API) userOIDC(rw http.ResponseWriter, r http.Request) {`
`1358`	`1358`	`emailSp := strings.Split(email, "@")`
`1359`	`1359`	`if len(emailSp) == 1 {`
`1360`	`1360`	`httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{`
`1361`		`- Message: fmt.Sprintf("Your email %q is not in domains %q!", email, api.OIDCConfig.EmailDomain),`
	`1361`	`+ Message: fmt.Sprintf("Your email %q is not from an authorized domain! Please contact your administrator.", email),`
`1362`	`1362`	`})`
`1363`	`1363`	`return`
`1364`	`1364`	`}`
`@@ -1373,7 +1373,7 @@ func (api API) userOIDC(rw http.ResponseWriter, r http.Request) {`
`1373`	`1373`	`}`
`1374`	`1374`	`if !ok {`
`1375`	`1375`	`httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{`
`1376`		`- Message: fmt.Sprintf("Your email %q is not in domains %q!", email, api.OIDCConfig.EmailDomain),`
	`1376`	`+ Message: fmt.Sprintf("Your email %q is not from an authorized domain! Please contact your administrator.", email),`
`1377`	`1377`	`})`
`1378`	`1378`	`return`
`1379`	`1379`	`}`