Add ability to display arbitrary error modal messages in Rewards flows (in brave://rewards)

brave / brave-browser

Brave browser for Android, iOS, Linux, macOS, Windows.

https://brave.com

Mozilla Public License 2.0

17.92k stars 2.34k forks source link

Add ability to display arbitrary error modal messages in Rewards flows (in brave://rewards) #20637

Open Miyayes opened 2 years ago

Miyayes commented 2 years ago

Description

When a certain error code # comes back from the server, parse the body of the response and display whatever arbitrary error message is responded by the server. The goal is to allow us to show certain error messaging on the fly, and not only show error messages that are hardcoded into the browser code.

Miyayes commented 2 years ago

@fmarier Not high priority, but thoughts on the passing of arbitrary data.

fmarier commented 2 years ago

passing of arbitrary data.

passing or parsing?

Which server are we talking about? Brave's or Uphold/Gemini/Bitflyer?

Miyayes commented 2 years ago

cc: @fmarier, could I get your views on how to implement this in a secure way?

fmarier commented 2 years ago

I confirmed with Chris that the messages would be coming from a Brave server, not from a third-party.

To be extra-safe, I would suggest:

The server should never pass through a message or error it gets from another server (e.g. passing through an error message from Uphold). Instead, it should parsing the error from the third-party server and produce its own Brave-controlled message without using text from the third-party server.
The client should treat the error text as potentially hostile and strip out any HTML tags it contains.