coder
diff --git a/‎coderd/domain_error_test.go
Lines changed: 0 additions & 122 deletions b/‎coderd/domain_error_test.go
Lines changed: 0 additions & 122 deletions
diff --git a/‎coderd/userauth_test.go
Lines changed: 73 additions & 0 deletions b/‎coderd/userauth_test.go
Lines changed: 73 additions & 0 deletions
@@ -1982,6 +1982,79 @@ func TestUserLogout(t *testing.T) {
 // - JWT with issuer https://secondary.com
 //
 // Without this security check disabled, all three above would have to match.
+
+// TestOIDCDomainErrorMessage ensures that when a user with an unauthorized domain
+// attempts to login, the error message doesn't expose the list of authorized domains.
+func TestOIDCDomainErrorMessage(t *testing.T) {
+	t.Parallel()
+
+	fake := oidctest.NewFakeIDP(t, oidctest.WithServing())
+
+	allowedDomains := []string{"allowed1.com", "allowed2.org", "company.internal"}
+	cfg := fake.OIDCConfig(t, nil, func(cfg *coderd.OIDCConfig) {
+		cfg.EmailDomain = allowedDomains
+		cfg.AllowSignups = true
+	})
+
+	server := coderdtest.New(t, &coderdtest.Options{
+		OIDCConfig: cfg,
+	})
+
+	// Test case 1: Email domain not in allowed list
+	t.Run("ErrorMessageOmitsDomains", func(t *testing.T) {
+		t.Parallel()
+
+		// Prepare claims with email from unauthorized domain
+		claims := jwt.MapClaims{
+			"email":          "user@unauthorized.com",
+			"email_verified": true,
+			"sub":            uuid.NewString(),
+		}
+
+		_, resp := fake.AttemptLogin(t, server, claims)
+		defer resp.Body.Close()
+
+		require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+		data, err := io.ReadAll(resp.Body)
+		require.NoError(t, err)
+
+		require.Contains(t, string(data), "is not from an authorized domain")
+		require.Contains(t, string(data), "Please contact your administrator")
+
+		for _, domain := range allowedDomains {
+			require.NotContains(t, string(data), domain)
+		}
+	})
+
+	// Test case 2: Malformed email without @ symbol
+	t.Run("MalformedEmailErrorOmitsDomains", func(t *testing.T) {
+		t.Parallel()
+
+		// Prepare claims with an invalid email format (no @ symbol)
+		claims := jwt.MapClaims{
+			"email":          "invalid-email-without-domain",
+			"email_verified": true,
+			"sub":            uuid.NewString(),
+		}
+
+		_, resp := fake.AttemptLogin(t, server, claims)
+		defer resp.Body.Close()
+
+		require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+		data, err := io.ReadAll(resp.Body)
+		require.NoError(t, err)
+
+		require.Contains(t, string(data), "is not from an authorized domain")
+		require.Contains(t, string(data), "Please contact your administrator")
+
+		for _, domain := range allowedDomains {
+			require.NotContains(t, string(data), domain)
+		}
+	})
+}
+
 func TestOIDCSkipIssuer(t *testing.T) {
 	t.Parallel()
 	const primaryURLString = "https://primary.com"