Closed KOliver94 closed 1 year ago
Hi @st4lk,
Can you consider merging this change?
Thanks!
Hey @KOliver94 !
I think it will be safer to not expose all errors to clients by default.
Agree it may be useful, but there is a potential risk that some information included in error can be dangerous: the error is returned to the server that has higher permissions than the browser client.
So by default such errors are not returned by API (will be logged on the server only). But there is a possibility to turn them on with REST_SOCIAL_VERBOSE_ERRORS = True
settings. It is up to developer.
I've done it here: https://github.com/st4lk/django-rest-social-auth/pull/168
Available in pypi rest-social-auth v8.0.0
Great! Thank you!
This PR fixes two potential problem:
message
only got extracted from an exception if the exception is not anAuthException
orLOG_AUTH_EXCEPTIONS
is set toTrue
. I guess this is not the intended behavior and it should affect logging, not the returned HTTP error, so I separated them to try to get the message from all types of exception and return it in the response.social-core
'sSocialAuthBaseException
which in most cases define a__str__
function. So, as a fallback return the string version of the exception in the message.