Insecure Error Handling

2020-09-2503:51:11

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

error handling

token revocation

unexpected behaviors

server security

token validity

EPSS

0.002

Percentile

52.5%

JSON

github.com/ory/fosite does not securely handle errors from the server. The TokenRevocationHandler ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid and may lead to unexpected behaviors in the server.