Bryan Frimin 84a35c90e9 Add session transfer for SSO cookies on custom domains ...

After OIDC login, if the redirect targets a trust center custom
domain, the callback now redirects through a session-transfer
endpoint on that domain. The endpoint verifies an HMAC-signed,
time-limited token and sets the session cookie on the custom
domain before redirecting to the final URL.

The continue URL is bound into the signed token payload to
prevent open-redirect attacks via parameter tampering.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

2026-03-31 14:49:20 +02:00

2.3 KiB

Raw Blame History

View Raw