From 4baa9b6bc113285be8b2ef48bd1fcb4bd6e8aa99 Mon Sep 17 00:00:00 2001
From: Joe Au-Yeung <65426560+joeauyeung@users.noreply.github.com>
Date: Fri, 8 Aug 2025 12:06:18 -0400
Subject: [PATCH] wrap samlResponse in try/catch (#22984)

---
 apps/web/app/api/auth/saml/callback/route.ts | 26 +++++++++++---------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/apps/web/app/api/auth/saml/callback/route.ts b/apps/web/app/api/auth/saml/callback/route.ts
index 5bde149f7f..df6d447d95 100644
--- a/apps/web/app/api/auth/saml/callback/route.ts
+++ b/apps/web/app/api/auth/saml/callback/route.ts
@@ -9,23 +9,27 @@ import type { SAMLResponsePayload } from "@calcom/features/ee/sso/lib/jackson";
 import logger from "@calcom/lib/logger";
 
 async function handler(req: NextRequest) {
-  const log = logger.getSubLogger({ prefix: ["[SAML callback]"] });
+  const uid = uuid();
+  const log = logger.getSubLogger({ prefix: ["[SAML callback]", `trace: ${uid}`] });
   const { oauthController } = await jackson();
 
   const requestData = (await parseRequestData(req)) as SAMLResponsePayload;
 
-  const { redirect_url, error } = await oauthController.samlResponse(requestData);
+  try {
+    const { redirect_url, error } = await oauthController.samlResponse(requestData);
 
-  if (redirect_url) {
-    return NextResponse.redirect(redirect_url, 302);
-  }
+    if (redirect_url) {
+      return NextResponse.redirect(redirect_url, 302);
+    }
 
-  if (error) {
-    const uid = uuid();
-    log.error(
-      `Error authenticating user with error ${error} for relayState ${requestData?.RelayState} trace:${uid}`
-    );
-    return NextResponse.json({ message: `Error authorizing user. trace: ${uid}` }, { status: 400 });
+    if (error) {
+      const uid = uuid();
+      log.error(`Error authenticating user with error ${error} for relayState ${requestData?.RelayState}`);
+      return NextResponse.json({ message: `Error authorizing user. trace: ${uid}` }, { status: 400 });
+    }
+  } catch (error) {
+    log.error(`Error processing SAML response`, error);
+    return NextResponse.json({ message: `Error processing SAML response. trace: ${uid}` }, { status: 500 });
   }
 
   return NextResponse.json({ message: "No redirect URL provided" }, { status: 400 });