Linus Rath 49e8d08c23 fix: never follow redirects on OAuth token and revocation requests ...

The code exchange, token refresh and revocation POSTs carry the
authorization code, refresh token and client secret, and used a plain
`fetch` that follows redirects. The endpoints come from a validated
discovery document, but a redirect from them (or from an endpoint that
changed after discovery) re-sent the body to a host nobody validated.
These requests now fail on any redirect. A failed refresh still keeps
the refresh token, as for any other outage.

2026-09-26 15:13:41 +02:00

..

route.ts

fix: never follow redirects on OAuth token and revocation requests

2026-09-26 15:13:41 +02:00