Customizable error messages output

[insotriplesix]

Salute! \0

I need to change the default template of error messages like 403 Forbidden or 404 NotFound from this:

{
  "error": {
    "code": 403,
    "status": "Forbidden",
    "message": "Access credentials are not sufficient to access this resource"
  }
}

to my own.

During the investigation I found this thread where Arthur already asked the same question. Further, the issue was resolved by hackerman in this commit where he added customizable error handlers. I took a glance to the code he wrote, read the documentation & tried to figured out how these changes can help me to solve the problem, but I still don't get it.

So, is it even possible to change the body of an error output? E.g. do something like this in the config file:

errors:
  fallback:
    - json
  handlers:
    json:
      enabled: true
      config:
        error_template: file:///path/to/my-error-template.json

If Arthur's issue was closed then I assume that it is possible to do.. somehow. I also found this article where Daniel have error responses like this one:

{
  "error": {
    "code": 404,
    "status": "Not Found",
    "request": "84a2b164-7229-4f69-a0cd-227611c07128",
    "message": "Requested url does not match any rules"
  }
}

and because of the request field I suggest that an error output can vary and be configured or something.

BTW if it's not possible yet, I already tried to achieve this in a different way - with the redirect handler:

errors:
  fallback:
    - redirect
  handlers:
    redirect:
      enabled: true
      config:
        to: https://my.domain.com/403.json

Finally, It allowed me to get the output of an error message I wanted to, but there are also some problems with it:

1. The "real" HTTP response status after successful redirection is 200 OK, so it's a bit confusing, and not what I actually want, because the body is:

{
  "message": "Operation not allowed",
  "code": 403,
  "errors": []
}

2. What if I want to redirect 403 Forbidden errors to https://my.domain.com/403.json and 404 NotFound to https://my.domain.com/404.json ? How can I achieve this? This is how I (approximately) tried to:

errors:
  fallback:
    - redirect
  handlers:
    redirect:
      enabled: true
      config:  
        when:
          - error: forbidden
            to: https://my.domain.com/403.json
          - error: not_found
            to: https://my.domain.com/404.json

Neither the documentation nor different keyword combinations, permutations, indents helped me. It just doesn't work. ¯\(ツ)/¯

[vinckr]

Hey @5aboteur,
is your use case related to this: ory/kratos#1348 ?

To quote:

This is not really solved in kratos, but should rather be solved in your UI.
You can just map the response you get to some translation you actually want to display.

Right now we just have IDs so you can map messages to your own strings. You have to interpret the context on your own and we don't have a neat overview over all the IDs and associated contexts. The message you see is just a sensible default you can display if you don't want to bother rewriting all the messages. [...] Everything happens in the text package, including all the constants.

Let me know if that helps! 🐝

[insotriplesix]

Hi @vinckr,

We are using our own identity provider implementation on the back-end side and yeah, I can change the body of an output error message there, but still the result forbidden message is this:

{
  "error": {
    "code": 403,
    "status": "Forbidden",
    "message": "Access credentials are not sufficient to access this resource"
  }
}

So, this is what the front-end side gets, but as back-end team we don't want to send it - we want the different format of an output message here. As I understand Oathkeeper reconvert the message (no matter what it gets) to its defaults, and it seems that it's not possible to just map the response you get to some translation you actually want to display in our case. If you meant that we should map this Oathkeeper message to a different one, then that's not what we want to achieve. We wanted to just replace it.

BTW, thank you for the reply.

[vinckr]

Hey @insotriplesix, just checking in if your problem still persists.
I am not sure if you can replace the message, but tbh I am out of me depth in this issue.
Maybe you can open a feature request with more some more details on the use case and how this would be a good addition to Ory Oathkeeper in general.

I will mark this as answered for now, but feel free to come back to the discussion any time.

Thanks a ton 🐝

[insotriplesix]

Hi @vinckr
It's been a while :-)

I'm no longer on the project, so I don't know if my ex-teammates still struggle with the problem. But if I remember correctly they did some workarounds, so it should be fine.

Thanks for the reply and have a good day!