Merge pull request #1667 from spotify/rugvip/noncens

auth-backend: tweak error messages

plugins/auth-backend/src/lib/OAuthProvider.test.ts

@@ -51,7 +51,7 @@ describe('OAuthProvider Utils', () => {
       } as unknown) as express.Request;
       expect(() => {
         verifyNonce(mockRequest, 'providera');
-      }).toThrowError('Missing nonce');
+      }).toThrowError('Auth response is missing cookie nonce');
     });
 
     it('should throw error if state nonce missing', () => {
@@ -63,7 +63,7 @@ describe('OAuthProvider Utils', () => {
       } as unknown) as express.Request;
       expect(() => {
         verifyNonce(mockRequest, 'providera');
-      }).toThrowError('Missing nonce');
+      }).toThrowError('Auth response is missing state nonce');
     });
 
     it('should throw error if nonce mismatch', () => {

plugins/auth-backend/src/lib/OAuthProvider.ts

@@ -43,10 +43,12 @@ export const verifyNonce = (req: express.Request, providerId: string) => {
   const cookieNonce = req.cookies[`${providerId}-nonce`];
   const stateNonce = req.query.state;
 
-  if (!cookieNonce || !stateNonce) {
-    throw new Error('Missing nonce');
+  if (!cookieNonce) {
+    throw new Error('Auth response is missing cookie nonce');
+  }
+  if (!stateNonce) {
+    throw new Error('Auth response is missing state nonce');
   }
-
   if (cookieNonce !== stateNonce) {
     throw new Error('Invalid nonce');
   }
@@ -151,9 +153,8 @@ export class OAuthProvider implements AuthProviderRouteHandlers {
       }
 
       if (!this.options.disableRefresh) {
-        // throw error if missing refresh token
         if (!refreshToken) {
-          throw new Error('Missing refresh token');
+          throw new InputError('Missing refresh token');
         }
 
         // set new refresh token