The authorization server sent back an error parameter instead of a code.
errorCode and the description are provider-supplied text that reaches
this constructor before any state check has passed, so both are put
through sanitizeErrorCode/sanitizeErrorDescription above. errorCode
exposes the sanitized value, not the raw one: it is a public readonly
field callers are expected to branch and display on, so handing them the
unfiltered string would just move the same problem one call frame out.
The authorization server sent back an
errorparameter instead of a code.errorCodeand the description are provider-supplied text that reaches this constructor before anystatecheck has passed, so both are put throughsanitizeErrorCode/sanitizeErrorDescriptionabove.errorCodeexposes the sanitized value, not the raw one: it is a public readonly field callers are expected to branch and display on, so handing them the unfiltered string would just move the same problem one call frame out.