Skip to content

fix: return 404 instead of 401 for missing OAuth2 apps #18755

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: return 404 instead of 401 for missing OAuth2 apps #18755

wants to merge 1 commit into from
+187 −49

Conversation

ThomasK33
Copy link
Member

Problem

Users were being automatically logged out when deleting OAuth2 applications.

Root Cause

  1. User deletes OAuth2 app successfully
  2. React Query automatically refetches the app data
  3. Management API incorrectly returned 401 Unauthorized for the missing app
  4. Frontend axios interceptor sees 401 and calls signOut()
  5. User gets logged out unexpectedly

Solution

  • Change management API to return 404 Not Found for missing OAuth2 apps
  • OAuth2 protocol endpoints continue returning 401 per RFC 6749
  • Rename writeInvalidClient to writeClientNotFound for clarity

Additional Changes

  • Add conditional OAuth2 navigation when experiment is enabled or in dev builds
  • Add isDevBuild() utility and buildInfo to dashboard context
  • Minor improvements to format script and warning dialogs

@ThomasK33 ThomasK33 requested a review from BrunoQuaresma July 4, 2025 13:33
@ThomasK33 ThomasK33 force-pushed the fix/oauth2-app-deletion-logout branch from 7fac49d to 932c04f Compare July 4, 2025 13:51
@ThomasK33
fix: return 404 instead of 401 for missing OAuth2 apps in management API
eb425dd 
This prevents users from being logged out when deleting OAuth2 apps.
The frontend interceptor triggers logout on 401 responses, but React Query
refetches deleted apps and should get 404, not 401.

Also adds conditional OAuth2 navigation when experiment is enabled.

Change-Id: I48886144883539b7c51307f2a500f95be31dd383
Signed-off-by: Thomas Kosiewski <[email protected]>
@ThomasK33 ThomasK33 force-pushed the fix/oauth2-app-deletion-logout branch from 932c04f to eb425dd Compare July 4, 2025 13:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@BrunoQuaresma BrunoQuaresma Awaiting requested review from BrunoQuaresma

At least 1 approving review is required to merge this pull request.

Assignees

@ThomasK33 ThomasK33

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@ThomasK33