- Shipped
- September 17, 2026 at 3:14 AM UTC
- Author
- Kamo
- Commit
- 46bb051
The Connect button navigated to **************** MediaService trusted both values with no session, so anyone who knew a connection id could bind their own page to another org's connection, and returnUrl was an open redirect (mediaservice 08b81d7 closes that side). On the console host the URL also had no route at all, so the button 404ed. Now the button creates the draft connection as before, then POSTs { connectionId, returnUrl } to the new **************** proxy route. MediaService checks the session may manage the connection and keeps the connection and the return URL server-side, and the browser navigates to the startUrl it answers. returnUrl is now absolute (origin + path + query), because MediaService only returns a browser to a console origin of the org. If connect-start refuses (for example no Meta app is configured), the screen shows the existing "couldn't connect" message and lists the draft unconnected, the way a decoderd authorization leaves it. No new translation keys. **************** pins the request and the refusal path, and fails if the screen builds a start URL carrying the connection or the return URL again.