feat: Add an option to return authorize errors to the client

docs/reference/options.rst

@@ -21,6 +21,10 @@ IdentityServer Options
 * ``StrictJarValidation``
     When enabled, applies strict JWT-secured authorization request validation, including typ and content-type checks, according to IETF spec. Defaults to ``false``.
 
+* ``StrictAuthorizeErrorResponses``
+    When enabled, the authorize endpoint returns every error to the client's redirect URI once the redirect URI and response mode have been validated, as RFC 6749 section 4.1.2.1 describes. Errors found before that still go to the error page: an unknown client or redirect URI, an invalid request object or ``request_uri``, and a missing or unknown ``response_type``.
+    Defaults to ``false``, which returns only ``access_denied``, ``account_selection_required``, ``login_required``, ``consent_required`` and ``interaction_required`` to the client.
+
 * ``EnableAuthorizeResponseIssuerParam``
     When enabled, the authorize response will include the issuer ``iss`` parameter, and advertises support in the discovery document. Defaults to ``false``.
 

src/Open.IdentityServer/src/Configuration/DependencyInjection/Options/IdentityServerOptions.cs

@@ -50,6 +50,11 @@ public class IdentityServerOptions
     /// </summary>
     public bool StrictJarValidation { get; set; } = false;
 
+    /// <summary>
+    /// Specifies whether the authorize endpoint returns all errors to the client once the redirect URI and response mode have been validated, as RFC 6749 section 4.1.2.1 describes.
+    /// </summary>
+    public bool StrictAuthorizeErrorResponses { get; set; } = false;
+
     /// <summary>
     /// Gets or sets the supported JWT request object signing algorithms.
     /// Defaults to an empty collection.

src/Open.IdentityServer/src/Endpoints/Results/AuthorizeResult.cs

@@ -85,7 +85,9 @@ private async Task ProcessErrorAsync(HttpContext context)
             Response.Error == OidcConstants.AuthorizeErrors.ConsentRequired ||
             Response.Error == OidcConstants.AuthorizeErrors.InteractionRequired;
 
-        if (isSafeError)
+        var returnToClientInStrictMode = _options.StrictAuthorizeErrorResponses && Response.RedirectUri != null &&
+                                         Response.Request?.ResponseMode != null;
+        if (isSafeError || returnToClientInStrictMode)
         {
             // this scenario we can return back to the client
             await ProcessResponseAsync(context);

src/Open.IdentityServer/test/Open.IdentityServer.UnitTests/Endpoints/Results/AuthorizeResultTests.cs

@@ -97,6 +97,69 @@ public async Task SafeErrors_ShouldReturnToClient(string error)
         location.Should().Contain("#_");
     }
 
+    [Theory]
+    [InlineData(OidcConstants.AuthorizeErrors.InvalidRequest)]
+    [InlineData(OidcConstants.AuthorizeErrors.TemporarilyUnavailable)]
+    [InlineData(OidcConstants.AuthorizeErrors.UnmetAuthenticationRequirements)]
+    public async Task OtherErrors_WhenStrictAuthorizeErrorResponsesDisabled_ShouldRedirectToErrorPage(string error)
+    {
+        _response.Error = error;
+        _response.Request = new ValidatedAuthorizeRequest
+        {
+            ResponseMode = OidcConstants.ResponseModes.Query,
+            RedirectUri = "http://client/callback"
+        };
+
+        await _subject.ExecuteAsync(_context);
+
+        _mockErrorMessageStore.Messages.Count.Should().Be(1);
+        _context.Response.Headers["Location"].First().Should().StartWith("https://server/error");
+    }
+
+    [Theory]
+    [InlineData(OidcConstants.AuthorizeErrors.InvalidRequest)]
+    [InlineData(OidcConstants.AuthorizeErrors.TemporarilyUnavailable)]
+    [InlineData(OidcConstants.AuthorizeErrors.UnmetAuthenticationRequirements)]
+    [InlineData("some_error")]
+    public async Task OtherErrors_WhenStrictAuthorizeErrorResponsesEnabled_ShouldReturnToClient(string error)
+    {
+        _options.StrictAuthorizeErrorResponses = true;
+        _response.Error = error;
+        _response.Request = new ValidatedAuthorizeRequest
+        {
+            ResponseMode = OidcConstants.ResponseModes.Query,
+            RedirectUri = "http://client/callback"
+        };
+
+        await _subject.ExecuteAsync(_context);
+
+        _mockErrorMessageStore.Messages.Should().BeEmpty();
+        var location = _context.Response.Headers["Location"].First();
+        location.Should().StartWith("http://client/callback");
+        QueryHelpers.ParseQuery(new Uri(location).Query)["error"].First().Should().Be(error);
+    }
+
+    [Theory]
+    [InlineData(OidcConstants.ResponseModes.Query, null)]
+    [InlineData(null, "http://client/callback")]
+    public async Task OtherErrors_WhenStrictAuthorizeErrorResponsesEnabled_AndResponseNotRoutable_ShouldRedirectToErrorPage(
+        string responseMode, string redirectUri)
+    {
+        // the validator sets these only once the redirect uri and response mode are known to be valid
+        _options.StrictAuthorizeErrorResponses = true;
+        _response.Error = OidcConstants.AuthorizeErrors.InvalidRequest;
+        _response.Request = new ValidatedAuthorizeRequest
+        {
+            ResponseMode = responseMode,
+            RedirectUri = redirectUri
+        };
+
+        await _subject.ExecuteAsync(_context);
+
+        _mockErrorMessageStore.Messages.Count.Should().Be(1);
+        _context.Response.Headers["Location"].First().Should().StartWith("https://server/error");
+    }
+
     [Theory]
     [InlineData(OidcConstants.AuthorizeErrors.AccountSelectionRequired)]
     [InlineData(OidcConstants.AuthorizeErrors.LoginRequired)]