From ce761a9d2ca7a674d880016c6f122eed35bb0d9e Mon Sep 17 00:00:00 2001 From: Jeroen Schweitzer Date: Thu, 8 Jan 2026 13:58:39 +0100 Subject: [PATCH] debug: add logging for OIDC token validation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 --- src/domains/auth/oidc.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/domains/auth/oidc.py b/src/domains/auth/oidc.py index a052a3d..74e1708 100644 --- a/src/domains/auth/oidc.py +++ b/src/domains/auth/oidc.py @@ -190,8 +190,9 @@ async def get_current_user( raise HTTPException(status_code=401, detail="Invalid token format") # Validate issuer is in allowed list + logger.debug(f"Token issuer: {token_issuer}, allowed issuers: {oidc_config.issuers}") if not oidc_config.is_valid_issuer(token_issuer): - logger.warning(f"Invalid token issuer: {token_issuer}") + logger.warning(f"Invalid token issuer: {token_issuer} (allowed: {oidc_config.issuers})") raise HTTPException(status_code=401, detail="Invalid token issuer") # Get JWKS for this specific issuer @@ -315,12 +316,14 @@ async def get_optional_user( } if not credentials: + logger.debug("No credentials provided for optional auth") return None try: return await get_current_user(credentials) - except HTTPException: - # Invalid token - return None instead of raising + except HTTPException as e: + # Invalid token - log and return None instead of raising + logger.warning(f"Optional auth failed: {e.detail}") return None