From 4bc382c7d08c88ec0bff1690f0cde52aa01f3e7c Mon Sep 17 00:00:00 2001
From: Artyom Vancyan <artyom.vancyan2000@gmail.com>
Date: Sun, 10 Sep 2023 22:13:30 +0400
Subject: [PATCH 01/14] Add "Error handling" section

---
 docs/references/tutorials.md | 28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

diff --git a/docs/references/tutorials.md b/docs/references/tutorials.md
index 737b64b..58248e2 100644
--- a/docs/references/tutorials.md
+++ b/docs/references/tutorials.md
@@ -39,20 +39,20 @@ scopes required for the API endpoint.
 
 ```mermaid
 flowchart TB
-  subgraph level2["request (Starlette's Request object)"]
-    direction TB
-    subgraph level1["auth (Starlette's extended Auth Credentials)"]
+    subgraph level2["request (Starlette's Request object)"]
         direction TB
-        subgraph level0["provider (OAuth2 provider with client's credentials)"]
+        subgraph level1["auth (Starlette's extended Auth Credentials)"]
             direction TB
-            token["access_token (Access token for the specified scopes)"]
+            subgraph level0["provider (OAuth2 provider with client's credentials)"]
+                direction TB
+                token["access_token (Access token for the specified scopes)"]
+            end
         end
     end
-  end
-  style level2 fill:#00948680,color:#f6f6f7,stroke:#3c3c43;
-  style level1 fill:#2b75a080,color:#f6f6f7,stroke:#3c3c43;
-  style level0 fill:#5c837480,color:#f6f6f7,stroke:#3c3c43;
-  style token fill:#44506980,color:#f6f6f7,stroke:#3c3c43;
+    style level2 fill: #00948680, color: #f6f6f7, stroke: #3c3c43;
+    style level1 fill: #2b75a080, color: #f6f6f7, stroke: #3c3c43;
+    style level0 fill: #5c837480, color: #f6f6f7, stroke: #3c3c43;
+    style token fill: #44506980, color: #f6f6f7, stroke: #3c3c43;
 ```
 
 :::
@@ -129,6 +129,14 @@ approach is useful when there missing mandatory attributes in `request.user` for
 database. You need to define a route for provisioning and provide it as `redirect_uri`, so
 the [user context](/integration/integration#user-context) will be available for usage.
 
+## Error handling
+
+::: info NOTE
+
+This section is under development.
+
+:::
+
 <style>
 .info, .details {
   border: 0;

From 0df07c131a056ddad089e838f4ae6ed4a664fbfd Mon Sep 17 00:00:00 2001
From: Artyom Vancyan <artyom.vancyan2000@gmail.com>
Date: Mon, 11 Sep 2023 21:21:04 +0400
Subject: [PATCH 02/14] GH-22: Handle non-matching 'state' parameter case

---
 src/fastapi_oauth2/core.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/fastapi_oauth2/core.py b/src/fastapi_oauth2/core.py
index fcff201..069d92b 100644
--- a/src/fastapi_oauth2/core.py
+++ b/src/fastapi_oauth2/core.py
@@ -56,6 +56,7 @@ class OAuth2Core:
     _oauth_client: Optional[WebApplicationClient] = None
     _authorization_endpoint: str = None
     _token_endpoint: str = None
+    _state: str = None
 
     def __init__(self, client: OAuth2Client) -> None:
         self.client_id = client.client_id
@@ -83,6 +84,8 @@ def authorization_url(self, request: Request) -> str:
         oauth2_query_params = dict(state=state, scope=self.scope, redirect_uri=redirect_uri)
         oauth2_query_params.update(request.query_params)
 
+        self._state = oauth2_query_params.get("state")
+
         return str(self._oauth_client.prepare_request_uri(
             self._authorization_endpoint,
             **oauth2_query_params,
@@ -96,6 +99,8 @@ async def token_data(self, request: Request, **httpx_client_args) -> dict:
             raise OAuth2LoginError(400, "'code' parameter was not found in callback request")
         if not request.query_params.get("state"):
             raise OAuth2LoginError(400, "'state' parameter was not found in callback request")
+        if request.query_params.get("state") != self._state:
+            raise OAuth2LoginError(400, "'state' parameter does not match")
 
         redirect_uri = self.get_redirect_uri(request)
         scheme = "http" if request.auth.http else "https"

From abcd8ccd765bab016186e5af307895f7678c7296 Mon Sep 17 00:00:00 2001
From: Artyom Vancyan <artyom.vancyan2000@gmail.com>
Date: Mon, 11 Sep 2023 21:34:55 +0400
Subject: [PATCH 03/14] GH-22: Add tests for csrf workflow

---
 tests/test_oauth2.py | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/tests/test_oauth2.py b/tests/test_oauth2.py
index 63071d5..a9f9d2c 100644
--- a/tests/test_oauth2.py
+++ b/tests/test_oauth2.py
@@ -1,4 +1,6 @@
+from urllib.parse import parse_qs
 from urllib.parse import urlencode
+from urllib.parse import urlparse
 
 import pytest
 from httpx import AsyncClient
@@ -14,7 +16,11 @@ async def oauth2_workflow(get_app, idp=False, ssr=True, authorize_query="", toke
         response = await client.get("/oauth2/test/authorize" + authorize_query)  # Get authorization endpoint
         authorization_endpoint = response.headers.get("location") if ssr else response.json().get("url")
         response = await client.get(authorization_endpoint)  # Authorize
-        response = await client.get(response.headers.get("location") + token_query)  # Obtain token
+        token_url = response.headers.get("location")
+        query = {k: v[0] for k, v in parse_qs(urlparse(token_url).query).items()}
+        query.update({k: v[0] for k, v in parse_qs(token_query).items()})
+        token_url = "%s?%s" % (token_url.split("?")[0], urlencode(query))
+        response = await client.get(token_url)  # Obtain token
 
         response = await client.get("/user", headers=dict(
             Authorization=jwt_encode(response.json(), "")  # Set token
@@ -43,3 +49,16 @@ async def test_oauth2_pkce_workflow(get_app):
         tq = "&" + urlencode(dict(code_verifier=code_verifier))
         await oauth2_workflow(get_app, idp=True, authorize_query=aq, token_query=tq)
         await oauth2_workflow(get_app, idp=True, ssr=False, authorize_query=aq, token_query=tq, use_header=True)
+
+
+@pytest.mark.anyio
+async def test_oauth2_csrf_workflow(get_app):
+    for aq, tq in [
+        ("?state=test_state", "&state=test_state"),
+        ("?state=test_state", "&state=test_wrong_state")
+    ]:
+        try:
+            await oauth2_workflow(get_app, idp=True, authorize_query=aq, token_query=tq)
+            await oauth2_workflow(get_app, idp=True, ssr=False, authorize_query=aq, token_query=tq, use_header=True)
+        except AssertionError:
+            assert aq != tq

From 43bf9d7e66695422099a13b15cce58b1056de793 Mon Sep 17 00:00:00 2001
From: Artyom Vancyan <artyom.vancyan2000@gmail.com>
Date: Tue, 3 Oct 2023 21:01:45 +0400
Subject: [PATCH 04/14] Create an exceptions module

---
 src/fastapi_oauth2/core.py       | 6 +-----
 src/fastapi_oauth2/exceptions.py | 5 +++++
 2 files changed, 6 insertions(+), 5 deletions(-)
 create mode 100644 src/fastapi_oauth2/exceptions.py

diff --git a/src/fastapi_oauth2/core.py b/src/fastapi_oauth2/core.py
index 069d92b..fbfad5e 100644
--- a/src/fastapi_oauth2/core.py
+++ b/src/fastapi_oauth2/core.py
@@ -13,16 +13,12 @@
 from oauthlib.oauth2.rfc6749.errors import CustomOAuth2Error
 from social_core.backends.oauth import BaseOAuth2
 from social_core.strategy import BaseStrategy
-from starlette.exceptions import HTTPException
 from starlette.requests import Request
 from starlette.responses import RedirectResponse
 
 from .claims import Claims
 from .client import OAuth2Client
-
-
-class OAuth2LoginError(HTTPException):
-    """Raised when any login-related error occurs."""
+from .exceptions import OAuth2LoginError
 
 
 class OAuth2Strategy(BaseStrategy):
diff --git a/src/fastapi_oauth2/exceptions.py b/src/fastapi_oauth2/exceptions.py
new file mode 100644
index 0000000..4e5baf6
--- /dev/null
+++ b/src/fastapi_oauth2/exceptions.py
@@ -0,0 +1,5 @@
+from starlette.exceptions import HTTPException
+
+
+class OAuth2LoginError(HTTPException):
+    """Raised when any login-related error occurs."""

From 23658d3e014c21a4baad049ddf82d259f3f33392 Mon Sep 17 00:00:00 2001
From: Artyom Vancyan <artyom.vancyan2000@gmail.com>
Date: Fri, 6 Oct 2023 22:19:31 +0400
Subject: [PATCH 05/14] Define the initial set of exceptions

---
 src/fastapi_oauth2/exceptions.py | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/fastapi_oauth2/exceptions.py b/src/fastapi_oauth2/exceptions.py
index 4e5baf6..da4d7b4 100644
--- a/src/fastapi_oauth2/exceptions.py
+++ b/src/fastapi_oauth2/exceptions.py
@@ -1,5 +1,17 @@
 from starlette.exceptions import HTTPException
 
 
-class OAuth2LoginError(HTTPException):
-    """Raised when any login-related error occurs."""
+class OAuth2Error(HTTPException):
+    ...
+
+
+class OAuth2AuthenticationError(OAuth2Error):
+    ...
+
+
+class OAuth2BadCredentialsError(OAuth2Error):
+    ...
+
+
+class OAuth2InvalidRequestError(OAuth2Error):
+    ...

From 7b18c0ad2e592d6a53dd088f3ca9979cb64402ea Mon Sep 17 00:00:00 2001
From: Artyom Vancyan <artyom.vancyan2000@gmail.com>
Date: Fri, 6 Oct 2023 22:22:44 +0400
Subject: [PATCH 06/14] GH-22: Handle possible exceptions in token data
 obtaining flow

---
 src/fastapi_oauth2/core.py | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/src/fastapi_oauth2/core.py b/src/fastapi_oauth2/core.py
index fbfad5e..b52b70a 100644
--- a/src/fastapi_oauth2/core.py
+++ b/src/fastapi_oauth2/core.py
@@ -9,16 +9,19 @@
 from urllib.parse import urljoin
 
 import httpx
+from oauthlib.oauth2 import OAuth2Error
 from oauthlib.oauth2 import WebApplicationClient
-from oauthlib.oauth2.rfc6749.errors import CustomOAuth2Error
 from social_core.backends.oauth import BaseOAuth2
+from social_core.exceptions import AuthException
 from social_core.strategy import BaseStrategy
 from starlette.requests import Request
 from starlette.responses import RedirectResponse
 
 from .claims import Claims
 from .client import OAuth2Client
-from .exceptions import OAuth2LoginError
+from .exceptions import OAuth2AuthenticationError
+from .exceptions import OAuth2BadCredentialsError
+from .exceptions import OAuth2InvalidRequestError
 
 
 class OAuth2Strategy(BaseStrategy):
@@ -92,11 +95,11 @@ def authorization_redirect(self, request: Request) -> RedirectResponse:
 
     async def token_data(self, request: Request, **httpx_client_args) -> dict:
         if not request.query_params.get("code"):
-            raise OAuth2LoginError(400, "'code' parameter was not found in callback request")
+            raise OAuth2InvalidRequestError(400, "'code' parameter was not found in callback request")
         if not request.query_params.get("state"):
-            raise OAuth2LoginError(400, "'state' parameter was not found in callback request")
+            raise OAuth2InvalidRequestError(400, "'state' parameter was not found in callback request")
         if request.query_params.get("state") != self._state:
-            raise OAuth2LoginError(400, "'state' parameter does not match")
+            raise OAuth2InvalidRequestError(400, "'state' parameter does not match")
 
         redirect_uri = self.get_redirect_uri(request)
         scheme = "http" if request.auth.http else "https"
@@ -113,12 +116,16 @@ async def token_data(self, request: Request, **httpx_client_args) -> dict:
         headers.update({"Accept": "application/json"})
         auth = httpx.BasicAuth(self.client_id, self.client_secret)
         async with httpx.AsyncClient(auth=auth, **httpx_client_args) as session:
-            response = await session.post(token_url, headers=headers, content=content)
             try:
+                response = await session.post(token_url, headers=headers, content=content)
                 self._oauth_client.parse_request_body_response(json.dumps(response.json()))
                 return self.standardize(self.backend.user_data(self.access_token))
-            except (CustomOAuth2Error, Exception) as e:
-                raise OAuth2LoginError(400, str(e))
+            except OAuth2Error as e:
+                raise OAuth2InvalidRequestError(400, str(e))
+            except httpx.HTTPError as e:
+                raise OAuth2BadCredentialsError(400, str(e))
+            except (AuthException, Exception) as e:
+                raise OAuth2AuthenticationError(401, str(e))
 
     async def token_redirect(self, request: Request, **kwargs) -> RedirectResponse:
         access_token = request.auth.jwt_create(await self.token_data(request, **kwargs))

From 9ff9d5d4179eafeddd4bad7785b4a8c056457983 Mon Sep 17 00:00:00 2001
From: Artyom Vancyan <artyom.vancyan2000@gmail.com>
Date: Mon, 9 Oct 2023 18:00:40 +0400
Subject: [PATCH 07/14] Document custom exceptions

---
 src/fastapi_oauth2/exceptions.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/fastapi_oauth2/exceptions.py b/src/fastapi_oauth2/exceptions.py
index da4d7b4..1a6fce2 100644
--- a/src/fastapi_oauth2/exceptions.py
+++ b/src/fastapi_oauth2/exceptions.py
@@ -2,16 +2,16 @@
 
 
 class OAuth2Error(HTTPException):
-    ...
+    """Base OAuth2 exception."""
 
 
 class OAuth2AuthenticationError(OAuth2Error):
-    ...
+    """Raised when authentication fails."""
 
 
 class OAuth2BadCredentialsError(OAuth2Error):
-    ...
+    """Raised when credentials are invalid."""
 
 
 class OAuth2InvalidRequestError(OAuth2Error):
-    ...
+    """Raised when request is invalid."""

From fe43361987d042e0e2be168fa7b0dfb97f1d421f Mon Sep 17 00:00:00 2001
From: Artyom Vancyan <artyom.vancyan2000@gmail.com>
Date: Mon, 9 Oct 2023 19:18:40 +0400
Subject: [PATCH 08/14] GH-22: Merge two exception cases into one

---
 src/fastapi_oauth2/core.py | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/src/fastapi_oauth2/core.py b/src/fastapi_oauth2/core.py
index b52b70a..14917e4 100644
--- a/src/fastapi_oauth2/core.py
+++ b/src/fastapi_oauth2/core.py
@@ -20,7 +20,6 @@
 from .claims import Claims
 from .client import OAuth2Client
 from .exceptions import OAuth2AuthenticationError
-from .exceptions import OAuth2BadCredentialsError
 from .exceptions import OAuth2InvalidRequestError
 
 
@@ -120,10 +119,8 @@ async def token_data(self, request: Request, **httpx_client_args) -> dict:
                 response = await session.post(token_url, headers=headers, content=content)
                 self._oauth_client.parse_request_body_response(json.dumps(response.json()))
                 return self.standardize(self.backend.user_data(self.access_token))
-            except OAuth2Error as e:
+            except (OAuth2Error, httpx.HTTPError) as e:
                 raise OAuth2InvalidRequestError(400, str(e))
-            except httpx.HTTPError as e:
-                raise OAuth2BadCredentialsError(400, str(e))
             except (AuthException, Exception) as e:
                 raise OAuth2AuthenticationError(401, str(e))
 

From d022184e800e144ed93059e03e9369ecb8a64cca Mon Sep 17 00:00:00 2001
From: Artyom Vancyan <artyom.vancyan2000@gmail.com>
Date: Mon, 9 Oct 2023 19:19:13 +0400
Subject: [PATCH 09/14] GH-22: Remove the `OAuth2BadCredentialsError`

---
 src/fastapi_oauth2/exceptions.py | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/src/fastapi_oauth2/exceptions.py b/src/fastapi_oauth2/exceptions.py
index 1a6fce2..fba7b91 100644
--- a/src/fastapi_oauth2/exceptions.py
+++ b/src/fastapi_oauth2/exceptions.py
@@ -9,9 +9,5 @@ class OAuth2AuthenticationError(OAuth2Error):
     """Raised when authentication fails."""
 
 
-class OAuth2BadCredentialsError(OAuth2Error):
-    """Raised when credentials are invalid."""
-
-
 class OAuth2InvalidRequestError(OAuth2Error):
     """Raised when request is invalid."""

From d88ec2b95f7260c9f2bdd98d3d7dc58f2212f98f Mon Sep 17 00:00:00 2001
From: Artyom Vancyan <artyom.vancyan2000@gmail.com>
Date: Wed, 11 Oct 2023 19:05:01 +0400
Subject: [PATCH 10/14] GH-22: Document the error handling section

---
 docs/references/tutorials.md | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/docs/references/tutorials.md b/docs/references/tutorials.md
index 58248e2..8529b5e 100644
--- a/docs/references/tutorials.md
+++ b/docs/references/tutorials.md
@@ -131,11 +131,27 @@ the [user context](/integration/integration#user-context) will be available for
 
 ## Error handling
 
-::: info NOTE
+The exceptions that possibly can occur when using the library are reraised as `HTTPException` with the appropriate
+status code and a message describing the actual error cause. So they can be handled in a natural way by following the
+FastAPI [docs](https://fastapi.tiangolo.com/tutorial/handling-errors/) on handling errors and using the exceptions from
+the `fastapi_oauth2.exceptions` module.
 
-This section is under development.
+```python
+from fastapi_oauth2.exceptions import OAuth2AuthenticationError
 
-:::
+@app.exception_handler(OAuth2AuthenticationError)
+async def error_handler(request: Request, exc: OAuth2AuthenticationError):
+    return RedirectResponse(url="/login", status_code=303)
+```
+
+The complete list of exceptions is the following.
+
+- `OAuth2Error` - Base exception for all errors raised by the FastAPI OAuth2 library.
+- `OAuth2AuthenticationError` - An exception is raised when the authentication fails.
+- `OAuth2InvalidRequestError` - An exception is raised when the request is invalid.
+
+The request is considered invalid when one of mandatory parameters such as `state` or `code` is missing or the request
+did not succeed.
 
 <style>
 .info, .details {

From 2a23eded223ecc40546f2b618c0b5f6d7e92b65d Mon Sep 17 00:00:00 2001
From: Artyom Vancyan <artyom.vancyan2000@gmail.com>
Date: Thu, 12 Oct 2023 18:34:06 +0400
Subject: [PATCH 11/14] GH-22: Call the default middleware for non-http
 requests

---
 src/fastapi_oauth2/middleware.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/fastapi_oauth2/middleware.py b/src/fastapi_oauth2/middleware.py
index bd7f2cd..d5bd0aa 100644
--- a/src/fastapi_oauth2/middleware.py
+++ b/src/fastapi_oauth2/middleware.py
@@ -139,7 +139,10 @@ def __init__(
             config = OAuth2Config(**config)
         elif not isinstance(config, OAuth2Config):
             raise TypeError("config is not a valid type")
+        self.default_application_middleware = app
         self.auth_middleware = AuthenticationMiddleware(app, backend=OAuth2Backend(config, callback), **kwargs)
 
     async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
-        await self.auth_middleware(scope, receive, send)
+        if scope["type"] == "http":
+            return await self.auth_middleware(scope, receive, send)
+        await self.default_application_middleware(scope, receive, send)

From aa8f4b318816f73749c8cdca4d7ad60c2a61e6c4 Mon Sep 17 00:00:00 2001
From: Artyom Vancyan <artyom.vancyan2000@gmail.com>
Date: Thu, 12 Oct 2023 18:40:42 +0400
Subject: [PATCH 12/14] GH-22: Handle the authentication exceptions in the
 middleware

---
 src/fastapi_oauth2/middleware.py | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/fastapi_oauth2/middleware.py b/src/fastapi_oauth2/middleware.py
index d5bd0aa..8b91e32 100644
--- a/src/fastapi_oauth2/middleware.py
+++ b/src/fastapi_oauth2/middleware.py
@@ -10,6 +10,7 @@
 from typing import Union
 
 from fastapi.security.utils import get_authorization_scheme_param
+from jose.exceptions import JOSEError
 from jose.jwt import decode as jwt_decode
 from jose.jwt import encode as jwt_encode
 from starlette.authentication import AuthCredentials
@@ -17,6 +18,7 @@
 from starlette.authentication import BaseUser
 from starlette.middleware.authentication import AuthenticationMiddleware
 from starlette.requests import Request
+from starlette.responses import PlainTextResponse
 from starlette.types import ASGIApp
 from starlette.types import Receive
 from starlette.types import Scope
@@ -144,5 +146,9 @@ def __init__(
 
     async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
         if scope["type"] == "http":
-            return await self.auth_middleware(scope, receive, send)
+            try:
+                return await self.auth_middleware(scope, receive, send)
+            except (JOSEError, Exception) as e:
+                middleware = PlainTextResponse(str(e), status_code=401)
+                return await middleware(scope, receive, send)
         await self.default_application_middleware(scope, receive, send)

From 49938603badc5b7a3ecf54f4944aa81d9ca49028 Mon Sep 17 00:00:00 2001
From: Artyom Vancyan <artyom.vancyan2000@gmail.com>
Date: Thu, 12 Oct 2023 19:56:07 +0400
Subject: [PATCH 13/14] GH-22: Complete the "Error handling" section of the
 docs

---
 docs/references/tutorials.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/references/tutorials.md b/docs/references/tutorials.md
index 8529b5e..660cae6 100644
--- a/docs/references/tutorials.md
+++ b/docs/references/tutorials.md
@@ -150,8 +150,8 @@ The complete list of exceptions is the following.
 - `OAuth2AuthenticationError` - An exception is raised when the authentication fails.
 - `OAuth2InvalidRequestError` - An exception is raised when the request is invalid.
 
-The request is considered invalid when one of mandatory parameters such as `state` or `code` is missing or the request
-did not succeed.
+The request is considered invalid when one of the mandatory parameters, such as `state` or `code` is missing or the
+request fails. And the errors that occur during the OAuth steps are considered authentication errors.
 
 <style>
 .info, .details {

From b946f89eeea4a0a6056a645358df0d0b7fa5f757 Mon Sep 17 00:00:00 2001
From: Artyom Vancyan <artyom.vancyan2000@gmail.com>
Date: Thu, 12 Oct 2023 20:01:07 +0400
Subject: [PATCH 14/14] GH-22: Add an `exception_handler` sample in the demo
 app

---
 examples/demonstration/main.py | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/examples/demonstration/main.py b/examples/demonstration/main.py
index 19071b1..34027b4 100644
--- a/examples/demonstration/main.py
+++ b/examples/demonstration/main.py
@@ -1,12 +1,15 @@
 from fastapi import APIRouter
 from fastapi import FastAPI
+from fastapi import Request
 from fastapi.staticfiles import StaticFiles
 from sqlalchemy.orm import Session
+from starlette.responses import RedirectResponse
 
 from config import oauth2_config
 from database import Base
 from database import engine
 from database import get_db
+from fastapi_oauth2.exceptions import OAuth2Error
 from fastapi_oauth2.middleware import Auth
 from fastapi_oauth2.middleware import OAuth2Middleware
 from fastapi_oauth2.middleware import User
@@ -37,6 +40,15 @@ async def on_auth(auth: Auth, user: User):
 
 
 app = FastAPI()
+
+
+# https://fastapi.tiangolo.com/tutorial/handling-errors/
+@app.exception_handler(OAuth2Error)
+async def error_handler(request: Request, e: OAuth2Error):
+    print("An error occurred in OAuth2Middleware", e)
+    return RedirectResponse(url="/", status_code=303)
+
+
 app.include_router(router_api)
 app.include_router(router_ssr)
 app.include_router(oauth2_router)