waterWang opened a new pull request, #13788: URL: https://github.com/apache/apisix/pull/13788
### What does this PR do? Fixes #13776. When an OAuth2 identity provider redirects back to APISIX's redirect_uri with a standard error response (per RFC 6749 §4.1.2.1), the openid-connect plugin currently falls through to a generic 500 error. This is particularly problematic for the `temporarily_unavailable` code, which can occur during entirely nominal operation — e.g. Keycloak's login session expiring before the user completes authentication. This PR detects `error=temporarily_unavailable` on a GET callback and restarts the authentication flow (302 redirect back to the original URL) instead of dead-ending with a 500. Other error codes like `access_denied` / `login_required` reflect a deliberate outcome and are intentionally NOT retried. ### Why is this needed? `temporarily_unavailable` is a transient failure — the login attempt can be automatically retried without any user interaction. Returning a 500 on a recoverable condition is a bug. ### Verification - `error=temporarily_unavailable` on a GET callback → 302 redirect, flow restarts (recoverable) - `error=access_denied` → still 500 (deliberate outcome, not retried) - non-GET callback → still 500 - callback without session cookie → still 500 ### PR Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features this PR contains - [ ] I have added tests to cover this change (test suite in `t/`) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
