Location:src/app/pages/auth/oidc/OidcCallback.tsx, src/app/pages/auth/oidc/oidcState.ts (isStaleClientError, added in #67)
Problem
generateOidcAuthorizationUrl builds the URL locally and registerOidcClient only runs when no cached id exists, so a stale cached dynamic client id is only ever rejected on the redirect back (?error=invalid_client). That path is handled in OidcCallback.tsx, which never calls invalidateCachedClient, so a genuinely stale id is never auto-evicted and every login attempt fails until the user clears storage. (#67 fixed the opposite problem: over-eager invalidation on transient errors.)
Suggested fix
In the callback's error branch, when isStaleClientError(params) is true, resolve the issuer (from the stored OIDC state in sessionStorage or the login config) and call invalidateCachedClient(issuer) so the next attempt re-registers.
Follow-up from the September 2026 audit fix rounds.
**Location:** `src/app/pages/auth/oidc/OidcCallback.tsx`, `src/app/pages/auth/oidc/oidcState.ts` (`isStaleClientError`, added in #67)
### Problem
`generateOidcAuthorizationUrl` builds the URL locally and `registerOidcClient` only runs when no cached id exists, so a stale cached dynamic client id is only ever rejected on the redirect back (`?error=invalid_client`). That path is handled in `OidcCallback.tsx`, which never calls `invalidateCachedClient`, so a genuinely stale id is never auto-evicted and every login attempt fails until the user clears storage. (#67 fixed the opposite problem: over-eager invalidation on transient errors.)
### Suggested fix
In the callback's error branch, when `isStaleClientError(params)` is true, resolve the issuer (from the stored OIDC state in sessionStorage or the login config) and call `invalidateCachedClient(issuer)` so the next attempt re-registers.
---
_Follow-up from the September 2026 audit fix rounds._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 19:54:08 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Location:
src/app/pages/auth/oidc/OidcCallback.tsx,src/app/pages/auth/oidc/oidcState.ts(isStaleClientError, added in #67)Problem
generateOidcAuthorizationUrlbuilds the URL locally andregisterOidcClientonly runs when no cached id exists, so a stale cached dynamic client id is only ever rejected on the redirect back (?error=invalid_client). That path is handled inOidcCallback.tsx, which never callsinvalidateCachedClient, so a genuinely stale id is never auto-evicted and every login attempt fails until the user clears storage. (#67 fixed the opposite problem: over-eager invalidation on transient errors.)Suggested fix
In the callback's error branch, when
isStaleClientError(params)is true, resolve the issuer (from the stored OIDC state in sessionStorage or the login config) and callinvalidateCachedClient(issuer)so the next attempt re-registers.Follow-up from the September 2026 audit fix rounds.