Problem/Motivation

If sessionStorage.file_gate_access_token contains a non-ISO-8859-1 character — easy to hit when the token is pasted by hand during the manual step-up handoff — the step-up page's bridge request dies with the browser's raw fetch exception rendered under "Step-up failed":

Failed to execute 'fetch' on 'Window': Failed to read the 'headers' property from 'RequestInit': String contains non ISO-8859-1 code point.

The raw exception gives the user no hint about what went wrong or how to recover.

Steps to reproduce

  1. Configure an assurance-gated field (verify_at: redeem) and mint a signed URL.
  2. In the browser console, set sessionStorage.file_gate_access_token to a value containing a non-Latin-1 code point (for example the literal string ⌘V from a mis-paste).
  3. Load the signed URL. The step-up page attempts the bridge POST and surfaces the raw TypeError.

Proposed resolution

Validate the token shape before building the Authorization header — a compact JWS check such as /^[\w-]+\.[\w-]+\.[\w-]+$/ — and on mismatch show an actionable message ("stored token is not a valid token — re-copy it and try again") next to the Retry button. Keep the raw error in the console only.

Remaining tasks

Patch plus a JS test for the invalid-token path.

User interface changes

Clearer error message on the step-up page; no new elements.

API changes

None.

Data model changes

None.

GitHub mirror issue: Wilkes-Liberty/file_gate#53

Comments

jmcerda created an issue. See original summary.

jmcerda’s picture

jmcerda
Location Boca Raton, FL
commented
Status: Active » Fixed

Fixed and released in 1.6.0 (https://www.drupal.org/project/file_gate/releases/1.6.0).

The step-up page now checks both stored values — the access token (window.fileGateAccessToken or sessionStorage.file_gate_access_token) and the DPoP proof (window.fileGateDpopProof) — against a compact-JWS shape regex before any bridge call. A mismatch shows an actionable message with the raw diagnostic in the browser console, and the page's error handler no longer surfaces raw exception internals in the UI.

Development PR with kernel coverage of the rendered page: https://github.com/Wilkes-Liberty/file_gate/pull/61

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.