Skip to content

auth: log the real error on OIDC callback failures

Aiho Tehisaru requested to merge fix/oidc-callback-error-logging into trunk

Summary

OIDC login failed in prod with a bare "token exchange failed" and no way to see why — every error branch in CallbackHandler (state lookup, token exchange, missing id_token, ID-token verification) discarded the actual error and returned only a generic message to the browser.

  • internal/auth/oidc.go: log.Printf the real error at each of those points, matching the existing log.Printf-style logging used elsewhere (cmd/rax/main.go, internal/web/devices.go).

Doesn't change any behavior — same responses to the browser, just visible diagnostics in Rax's own logs now. Needed to actually diagnose the rax.hop179.net token-exchange failure the operator hit.

Test plan

  • gofmt -s -w . && gofmt -l . && go build ./... && go vet ./... && go test ./... — clean

🤖 Generated with Claude Code

https://claude.ai/code/session_01U9buZPRQy7YXLodkSPFFik

Merge request reports