- Shipped
- September 17, 2026 at 4:21 AM UTC
- Author
- Kamo
- Commit
- 5ec18e5
POST /api/media/canva/connect-start stored whatever returnUrl the body named, and the OAuth callback on the API host redirects to it after Canva's consent screen. Any signed-in member could therefore mint a Canva connect link that lands whoever follows it on an arbitrary site, from a Kamo host — the open redirect fixed in the Meta flow (08b81d7), behind a session. The return URL now goes through the same OAuthReturnUrlPolicy: an https URL with a path on a console origin of the member's organization (its live domain, its security providers', the platform's) is kept, anything else becomes the org's own Canva settings screen. The settings screen already sends its own absolute URL, so a real connect lands where it did. CanvaConnectReturnUrlTest drives connectStart with the real policy; storing the raw value fails its first test.