goauthentik
Flows should be aborted on policy errors
Is your feature request related to a problem? Please describe. When creating a flow that uses an expression policy, an error in the policy causes the last step of the flow to be executed. This can be a potential security issue.
If a policy throws an error, the intended behavior of the flow is undefined. The only safe default is to abort the flow. In my experiments, I had for example users being created although the policy should have prevented it, due to a policy error.
Describe the solution you'd like The default for any created flow should be to abort if there is a policy error.
When a policy throws an error the behaviour is not undefined, you can configure the policy result when a policy fails in the binding here:
By undefined I mean authentik cannot know what should happen. Therefore the default should be "Don't pass".