Function renderError

internal/oauth/callback.go:152–157

renderError shows the failure page. html/template auto-escapes msg, so a hostile error_description cannot inject markup.

(w http.ResponseWriter, msg string)

// renderError shows the failure page. html/template auto-escapes msg, so a
// hostile error_description cannot inject markup.
func renderError(w http.ResponseWriter, msg string) {
	w.Header().Set("Content-Type", "text/html; charset=utf-8")
	if err := errorTemplate.Execute(w, struct{ ErrorMessage string }{ErrorMessage: msg}); err != nil {
		http.Error(w, "internal error", http.StatusInternalServerError)
	}
}