starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Enhancement]: More detailed error message instead of "Unauthorized" when [OidcAuth] fails for user #3074

New Issue
Open
opened 2026-04-25 00:13:31 +02:00 by adam · 2 comments
adam commented 2026-04-25 00:13:31 +02:00
Owner
Copy Link
Copy Source

Originally created by @ZLoth on GitHub (Nov 4, 2025).

Type of Enhancement

None

Describe the Feature/Enhancement

If ABS is configured with a Oidc provider such as Authentik, then a more detailed error message should be displayed instead of "Unauthorized" such as "Unauthorized - Not a email validated user". Detailed error messages should configured at the Authentication settings in ABS.

Why would this be helpful?

As currently implemented, the [OidcAuth] component of ABS will only return Unauthorized. This requires that the administrator request the time of failure and review the ABS logs for details.

This is related to https://github.com/advplyr/audiobookshelf/issues/4794 where the root cause was that "email_verified": false was being passed as part of the JWT Payload.

Future Implementation (Screenshot)

"Unauthorized - Email is not verified".

Audiobookshelf Server Version

2.30

Current Implementation (Screenshot)

"Unauthorized"

Originally created by @ZLoth on GitHub (Nov 4, 2025). ### Type of Enhancement None ### Describe the Feature/Enhancement If ABS is configured with a Oidc provider such as Authentik, then a more detailed error message should be displayed instead of "Unauthorized" such as "Unauthorized - Not a email validated user". Detailed error messages should configured at the Authentication settings in ABS. ### Why would this be helpful? As currently implemented, the [OidcAuth] component of ABS will only return Unauthorized. This requires that the administrator request the time of failure and review the ABS logs for details. This is related to https://github.com/advplyr/audiobookshelf/issues/4794 where the root cause was that `"email_verified": false` was being passed as part of the JWT Payload. ### Future Implementation (Screenshot) "Unauthorized - Email is not verified". ### Audiobookshelf Server Version 2.30 ### Current Implementation (Screenshot) "Unauthorized"
adam added the enhancement label 2026-04-25 00:13:31 +02:00
adam commented 2026-04-25 00:13:31 +02:00
Author
Owner
Copy Link
Copy Source

@Vito0912 commented on GitHub (Nov 4, 2025):

This gets logged in the logs already. From a security standpoint it is not really good to tell the user anything admin related imho.
E-Mail not verified should be handeled at the Authentik layer (e.g. not letting the people use the service in the first plac,e because well, their email is not verified).

@Vito0912 commented on GitHub (Nov 4, 2025): This gets logged in the logs already. From a security standpoint it is not really good to tell the user anything admin related imho. E-Mail not verified should be handeled at the Authentik layer (e.g. not letting the people use the service in the first plac,e because well, their email is not verified).
adam commented 2026-04-25 00:13:31 +02:00
Author
Owner
Copy Link
Copy Source

@ZLoth commented on GitHub (Nov 4, 2025):

From a security standpoint it is not really good to tell the user anything admin related imho.

Let the administrator make the decision then. That's why I included the following as part of the feature request:

Detailed error messages should configured at the Authentication settings in ABS.

I may temporarily turn on verbose mode to assist with configuration, especially with new administrators. Password failures should already be caught at the Authentik level. The fact that "email_verified": false was hard coded as part of the JWT payload is a bad thing.

@ZLoth commented on GitHub (Nov 4, 2025): > From a security standpoint it is not really good to tell the user anything admin related imho. Let the administrator make the decision then. That's why I included the following as part of the feature request: > Detailed error messages should configured at the Authentication settings in ABS. I may temporarily turn on verbose mode to assist with configuration, especially with new administrators. Password failures should already be caught at the Authentik level. The fact that `"email_verified": false` was hard coded as part of the JWT payload is a bad thing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#3074
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?