- Shipped
- November 13, 2026 at 8:43 AM UTC
- Author
- Kamo
- Commit
- f4ad947
A Verified Recipients doc link on sign.<org> sends a newcomer to register.<apex>/member?doc=<the doc page URL>. Mirrors careers' applyHandoff: - The URL is accepted only as https://sign.<this apex>/<xx>/d/<43-char token> (no query, fragment, port or credentials) and parked in the kamo_doc_return apex cookie, so it survives email verification in another tab. Never an open redirect: the sign host's own handoff can only return to that doc page. - The header says "Create your account to open {Doc} from {Sender}". The names come from the sign host (/api/doc/<token>/hint, parked there when it drew the sign-in gate), never from the URL, so a crafted link cannot put words on this page; without them it reads "...open the document shared with you". - The auto-session one-time key goes to <doc page>/session?otk= instead of internal.<apex>/validate, and every sign-in link (header, linked account, registered, email verified, already verified) carries ?return=<doc page>.