fix(security): validate extension callback state

2026-09-02 16:20:57 +02:00 · 2026-08-29 18:53:33 +07:00
parent 29db940d63
commit 63d29d2ed4
10 changed files with 236 additions and 51 deletions
@@ -91,7 +91,7 @@
                <data android:scheme="https" android:host="music.youtube.com" />
            </intent-filter>

-            <!-- Extension OAuth (PKCE) redirect: spotiflac://callback?code=...&state=<extension_id> -->
+            <!-- Extension OAuth (PKCE) redirect with host-generated one-time state. -->
            <intent-filter>
                <action android:name="android.intent.action.VIEW" />
                <category android:name="android.intent.category.DEFAULT" />