From b8a981fea9cc5efc337be4a0d93e9f9763912b91 Mon Sep 17 00:00:00 2001
From: Elaine Souza <elaine.souza@wildlifestudios.com>
Date: Tue, 4 Aug 2026 09:31:06 -0300
Subject: [PATCH] Use friendly login-failed message for malformed state error
 page

Keeps err.Error() as the debug-only message and shows a user-facing
message consistent with the other 403 auth-failure branches in
OAuthCallback, per review feedback on PR #3453.
---
 oauthproxy.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/oauthproxy.go b/oauthproxy.go
index 580bf8b7..165c82ae 100644
--- a/oauthproxy.go
+++ b/oauthproxy.go
@@ -913,7 +913,7 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
 		// the pre-v7.7.1 behaviour and is consistent with the other auth-failure
 		// paths below (CSRF cookie missing, CSRF mismatch), which also return 403.
 		logger.Errorf("Error while parsing OAuth2 state: %v", err)
-		p.ErrorPage(rw, req, http.StatusForbidden, err.Error())
+		p.ErrorPage(rw, req, http.StatusForbidden, err.Error(), "Login Failed: invalid or missing state parameter.")
 		return
 	}