Add error page for CSRF

CHANGELOG.md

@@ -1,3 +1,5 @@
+## v2.1.2
+
 ## v2.1.1
 
 ### Fixes and improvements

lib/claper_web/controllers/user_oidc_auth.ex

@@ -40,13 +40,19 @@ defmodule ClaperWeb.UserOidcAuth do
       conn
       |> UserAuth.log_in_user(oidc_user.user)
     else
-      {:error, _} ->
+      {:error, reason} ->
         conn
-        |> put_flash(:error, "Cannot authenticate user.")
-        |> redirect(to: ~p"/users/log_in")
+        |> put_status(:unauthorized)
+        |> put_view(ClaperWeb.ErrorView)
+        |> render("csrf_error.html", %{error: "Authentication failed: #{inspect(reason)}"})
     end
+  end
 
+  def callback(conn, %{"error" => error} = _params) do
     conn
+    |> put_status(:unauthorized)
+    |> put_view(ClaperWeb.ErrorView)
+    |> render("csrf_error.html", %{error: "Authentication failed: #{error}"})
   end
 
   defp config do

lib/claper_web/templates/error/csrf_error.html.heex

@@ -0,0 +1,22 @@
+<div class="min-h-screen flex items-center justify-center bg-gray-100">
+  <div class="max-w-3xl w-full p-10">
+    <div class="text-center">
+      <h1 class="text-4xl font-bold text-gray-900 mb-2"><%= gettext("CSRF Verification Failed") %></h1>
+      <p class="text-lg text-gray-700 mb-8"><%= gettext("A required security token was not found or was invalid.") %></p>
+    </div>
+
+    <div class="space-y-6 text-center">
+      <p class="text-gray-700"><%= gettext("If you're continually seeing this issue, try the following:") %></p>
+      <ol class="list-decimal list-inside space-y-2 text-gray-600">
+        <li><%= gettext("Clear cookies (at least for Claper domain)") %></li>
+        <li><%= gettext("Reload the page you're trying to access (don't re-submit data)") %></li>
+        <li><%= gettext("Try logging in again") %></li>
+        <li><%= gettext("Ensure the URL does not contain an extra \"/\" anywhere") %></li>
+      </ol>
+      <p class="text-gray-700 mt-6"><%= gettext("If the problem persists, please contact support.") %></p>
+      <div class="mt-8">
+        <%= link gettext("Back to Login"), to: ~p"/users/log_in", class: "text-blue underline font-semibold transition duration-300 ease-in-out" %>
+      </div>
+    </div>
+  </div>
+</div>

mix.exs

@@ -1,7 +1,7 @@
 defmodule Claper.MixProject do
   use Mix.Project
 
-  @version "2.1.1"
+  @version "2.1.2"
 
   def project do
     [