feat(oidc): handle missing sub claim in token and redirect with error

2025-12-28 02:15:26 +01:00
parent 5ad260a465
commit 17a535866b
1 changed files with 6 additions and 1 deletions
@@ -157,7 +157,12 @@ export async function oidcRoutes(app: FastifyInstance) {
        });
        
        // Get user info
-        const userInfo = await client.fetchUserInfo(config, tokens.access_token, tokens.claims()?.sub);
+        const sub = tokens.claims()?.sub;
+        if (!sub) {
+          console.error("[OIDC] Missing sub claim in token");
+          return reply.redirect(`${getFrontendUrl()}/?error=oidc_missing_sub`);
+        }
+        const userInfo = await client.fetchUserInfo(config, tokens.access_token, sub);
        
        // Extract username from configured claim
        const usernameClaim = env.OIDC_USERNAME_CLAIM;