yuanzonghao 11f5ca83ec fix(auth): reject control chars in OAuth callback next param ...

Defense-in-depth against header injection if the post-login redirect
target ever reaches a context that doesn't re-encode it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-13 23:19:44 +08:00

..

callback

fix(auth): reject control chars in OAuth callback next param

2026-06-13 23:19:44 +08:00