- Shipped
- November 13, 2026 at 8:44 AM UTC
- Author
- Kamo
- Commit
- 300169a
The doc page on sign.<org>/<locale>/d/<token> sends a Verified Recipients viewer here as login.<apex>/?return=<doc page>; kamo-register's sign-up parks the same URL in the kamo_doc_return apex cookie. On success - single workspace or picker - the one-time key SecurityService minted for internal.<apex>/validate goes to the doc page's handoff route (<doc page>/session?otk=) instead, which spends it the way /validate does and opens the document. Only https://sign.<this apex>/<xx>/d/<43-char token> is accepted (no query, fragment, port or credentials), so it cannot be an open redirect. A valid ?return= is parked in the apex cookie too, so an email-verification detour still ends on the document. Known gap: the MFA path leaves this page by a server redirect and still lands in the workspace.