diff --git a/handlers/oauth_handler.go b/handlers/oauth_handler.go
index d7b9e0d..055d4f6 100644
--- a/handlers/oauth_handler.go
+++ b/handlers/oauth_handler.go
@@ -147,7 +147,12 @@ func (h *OAuthHandler) HandleCallback(rw http.ResponseWriter, req *http.Request,
 		cookie, err := req.Cookie("_oidc_raczylo_m")
 		if err != nil {
 			h.logger.Errorf("Main session cookie not found in request: %v", err)
-			h.logger.Debugf("Available cookies: %v", req.Header.Get("Cookie"))
+			// Log cookie names only, not values (avoid logging sensitive session data)
+			cookieNames := make([]string, 0, len(req.Cookies()))
+			for _, c := range req.Cookies() {
+				cookieNames = append(cookieNames, c.Name)
+			}
+			h.logger.Debugf("Available cookies (names only): %v", cookieNames)
 		} else {
 			h.logger.Errorf("Main session cookie exists but CSRF token is empty. Cookie value length: %d", len(cookie.Value))
 			h.logger.Debugf("Cookie details - Domain: %s, Path: %s, Secure: %v, HttpOnly: %v, SameSite: %v",
diff --git a/utilities.go b/utilities.go
index 56347d2..ddfbc57 100644
--- a/utilities.go
+++ b/utilities.go
@@ -5,6 +5,7 @@ package traefikoidc
 import (
 	"encoding/json"
 	"fmt"
+	"html"
 	"net/http"
 	"runtime"
 	"strings"
@@ -144,6 +145,8 @@ func (t *TraefikOidc) sendErrorResponse(rw http.ResponseWriter, req *http.Reques
 	t.logger.Debugf("Sending HTML error response (code %d): %s", code, message)
 
 	returnURL := "/"
+	// Escape message to prevent XSS attacks
+	escapedMessage := html.EscapeString(message)
 
 	htmlBody := fmt.Sprintf(`
 <!DOCTYPE html>
@@ -165,7 +168,7 @@ func (t *TraefikOidc) sendErrorResponse(rw http.ResponseWriter, req *http.Reques
         <p><a href="%s">Return to application</a></p>
     </div>
 </body>
-</html>`, message, returnURL)
+</html>`, escapedMessage, returnURL)
 
 	rw.Header().Set("Content-Type", "text/html; charset=utf-8")
 	rw.WriteHeader(code)