Harden OAuth redirect handling (avoid open-redirect + token leakage)

[colebemis]

Problem

api/github-auth.ts builds a redirect URL from the state parameter and appends the GitHub access token (user_token) to the query string.

Impact

• If state can be attacker-controlled, this is an open redirect.
• Tokens in URLs can leak via logs, browser history, referrers, or third-party requests.

Suggested fix

• Treat state as an opaque CSRF token, not a URL.
• Only redirect to a fixed allowlisted origin (e.g., same-origin).
• Avoid putting tokens in the URL; use an httpOnly Secure cookie or a short-lived server-side session.

Files

• api/github-auth.ts