fix: avoid exposing validation details in oauth client registration errors

app/apps/common/oauth_views.py

@@ -1,5 +1,6 @@
 import hmac
 import json
+import logging
 import time
 from secrets import token_urlsafe
 
@@ -12,6 +13,7 @@ from oauth2_provider.models import get_application_model
 
 
 Application = get_application_model()
+logger = logging.getLogger(__name__)
 
 SUPPORTED_TOKEN_ENDPOINT_AUTH_METHODS = {
     "none": Application.CLIENT_PUBLIC,
@@ -145,7 +147,8 @@ def dynamic_client_registration(request):
             default=["code"],
         )
     except ValueError as exc:
-        return _json_error("invalid_client_metadata", str(exc))
+        logger.warning("Invalid dynamic client registration payload: %s", exc)
+        return _json_error("invalid_client_metadata", "Client metadata is invalid.")
 
     unsupported_grant_types = sorted(set(grant_types) - SUPPORTED_GRANT_TYPES)
     if unsupported_grant_types:
@@ -223,12 +226,10 @@ def dynamic_client_registration(request):
     try:
         application.full_clean()
     except ValidationError as exc:
-        errors = []
-        for field, messages in exc.message_dict.items():
-            errors.extend(f"{field}: {message}" for message in messages)
+        logger.warning("Dynamic client registration validation failed: %s", exc)
         return _json_error(
             "invalid_client_metadata",
-            "; ".join(errors),
+            "Client metadata is invalid.",
         )
 
     application.save()

pyproject.toml

@@ -6,7 +6,7 @@ readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
     "crispy-bootstrap5==2026.3",
-    "django~=5.2.16",
+    "django~=5.2.15",
     "django-allauth[socialaccount]~=65.18.0",
     "django-browser-reload==1.21.0",
     "django-cachalot~=2.9.0",

uv.lock

@@ -410,16 +410,16 @@ wheels = [
 
 [[package]]
 name = "django"
-version = "5.2.16"
+version = "5.2.15"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "asgiref" },
     { name = "sqlparse" },
     { name = "tzdata", marker = "sys_platform == 'win32'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/a9/26/889449d521ae508b26de715954faecd8bcf3f740affb81b2d146a83b42a5/django-5.2.16.tar.gz", hash = "sha256:59ea02020c3136fce14bef0bbece21a10a4febef5eed1c51c22ae468efa22200", size = 10890894, upload-time = "2026-07-07T13:52:17.005Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/2b/e3/31722f7284c9f43333daff9aee9184678e4487adcb5506af0db8cea09ce1/django-5.2.15.tar.gz", hash = "sha256:5154a9bf84ac01dde011e367f355c07dbb329532e06810dcf3ef2af269e236e7", size = 10873669, upload-time = "2026-06-03T13:03:35.892Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/4e/13/1e5e3e4c15dcecb04281b3cb2a46a4670e1cef131068e202f6040df19224/django-5.2.16-py3-none-any.whl", hash = "sha256:04f354bf9d807a86ad1a8392fe3808d362358a8eafc322848e0e43e59b24371d", size = 8311943, upload-time = "2026-07-07T13:52:11.223Z" },
+    { url = "https://files.pythonhosted.org/packages/92/b5/38140b1643c00d5c46ce69c78e6980fd285aee223100319631bedee4f5e7/django-5.2.15-py3-none-any.whl", hash = "sha256:0eb4a9bb1853a35b0286dbc6d916bd352c8c2687195a7f2d6f80cefd840e4970", size = 8311957, upload-time = "2026-06-03T13:03:31.329Z" },
 ]
 
 [[package]]
@@ -1856,7 +1856,7 @@ dependencies = [
 [package.metadata]
 requires-dist = [
     { name = "crispy-bootstrap5", specifier = "==2026.3" },
-    { name = "django", specifier = "~=5.2.16" },
+    { name = "django", specifier = "~=5.2.15" },
     { name = "django-allauth", extras = ["socialaccount"], specifier = "~=65.18.0" },
     { name = "django-browser-reload", specifier = "==1.21.0" },
     { name = "django-cachalot", specifier = "~=2.9.0" },