Error screen shows users auth token.

[JackFromWisconsin]

Requirements

• This is a bug report, and if not, please post to https://lemmy.ml/c/lemmy_support instead.
• Please check to see if this issue already exists.
• It's a single bug. Do not report multiple bugs in one issue.
• It's a frontend issue, not a backend issue; Otherwise please create an issue on the backend repo instead.

Summary

On v0.18 versions when Lemmy hits an error, it gives an error screen. Unfortunately, this error also gives out the users access token.

This is a major vulnerability, since the page almost encourages sharing the error page. This is a severe vulnerability because of: LemmyNet/lemmy#3364

Steps to Reproduce

1. Get a error (for example, one I got was" FetchError: request to http://lemmy:8536/api/v3/community?name=wisconsin&auth= failed, reason: connect ECONNREFUSED 172.18.0.5:8536."
2. The auth= part contains my token, edited out for security.
3. Accidentally share the error message and expose my account token

Technical Details

Independent of web browser/OS. Depends on when you get an error page.

Lemmy Instance Version

v0.18

Lemmy Instance URL

No response

[jsit]

Thanks @JackFromWisconsin. Where does this error appear? In a popup box in the lower-left? Can you include a screenshot, and/or steps to take to reproduce an error like this?

[JackFromWisconsin]

It is the full page error, not a pop-up. I will grab a screenshot next time I see it.

[JackFromWisconsin]

@SleeplessOne1917 thank you for fixing this right away!