Improve error pages (for Okta) - #726
Conversation
Improved nicer layout for 404 page Created framework for error pages so we don't just sent raw error messages to the user
| color : COLOR_WARNING, | ||
| icon : TbLockExclamation, | ||
| actions : <SsoActions />, | ||
| }, |
There was a problem hiding this comment.
Use "log in" instead of "sign in" terminology. This applies to multiple cases below as well
| sso_state_missing : { | ||
| title : 'Your sign-in session expired', | ||
| description : `We could not match this sign-in to a session we started. This usually happens | ||
| when a login is left open too long, or when cookies are blocked. Starting over should fix it.`, |
There was a problem hiding this comment.
"start over should fix it" could be misinterpreted as the game they are playing will be lost. Consider changing the message to something like "We could not find your login session. This usually happens when a login is left open too long or when cookies are blocked.", then letting the ssoActions provide the directions to fix.
Is the user going to know that their sso login is separate from our login session? Looking at "we started" as a vague "we" since they may not realize where one system starts vs another ends
| {`This application requires you to use your PIV/CAC card to log in. Please use `} | ||
| <RadixLink asChild> | ||
| <Link to={SSO_CARD_REGISTRATION_PATH} target="_blank" rel="noopener noreferrer"> | ||
| this link |
There was a problem hiding this comment.
Can we reorder this text to be more descriptive? "Please go to (CISA's Registration Portal)[link] and to update your PIV/CAC UPN information". I think we should try to not repeat "CISA Registration Portal" in each line.
There was a problem hiding this comment.
Also, I'm a little confused here because a CAC contains a PIV certificiate. A UPN is a separate identifier to the CAC and isn't a standardized value across agencies, so I think this is confusing which should be used.
| </RadixLink> | ||
| {` to update your PIV/CAC UPN information in CISA's Registration Portal. `} | ||
| {`Use your current password + MFA or Login.gov credentials to log in to the Registration Portal. `} | ||
| You will be able to use your PIV/CAC to login after updating that information in the CISA Registration Portal. |
There was a problem hiding this comment.
I think these can be part of the same multi-line block instead of closing and reopening the brackets for each one. They get rendered as a single paragraph
| description : `Your identity provider signed you in but did not share the details we need to | ||
| match you to an account. Trying again will often resolve it; if not, please contact support.`, | ||
| icon : TbLockExclamation, | ||
| actions : <SsoActions />, |
There was a problem hiding this comment.
Instead of the "Trying again" text, could we use both the ssoActions and SupportActions to direct them? If we can't, we should still include a link to both the login page and instructions on how to contact support.
|
|
||
| assert "</script><script>alert(1)</script>" not in body | ||
| # The text still survives intact once the browser parses the JSON string. | ||
| assert "</script><script>alert(1)</script>" in rendered_error(response)["detail"] |
There was a problem hiding this comment.
Is the first closing script tag intended? Opening and closing makes sense, but not the first closing one.
2 participants
Improved nicer layout for 404 page
Created framework for error pages so we don't just sent raw error messages to the user
Refactor stack trace capture