- Ya
- 23 Agosti 2026, 21:23 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 6f48a1c
Two faults, both on the same hop, and each one hides the other. RingCentral rejects every scope value this app can ask for — "invalid_request / Parameter [scope] value is invalid." — including permissions the app demonstrably holds and including the three-scope string that connected the first instance in July. Consent was never reached. Omitting the parameter is not a downgrade: RingCentral then issues the app's full registered set, a superset of what was listed. The callback then sent the browser to the configured internal.kamocrm.com. kamo-internal is routed by HostRegexp "^internal[.].+$", so an org on chinilaw.com lives at internal.chinilaw.com. The session id lives in per-origin sessionStorage, so landing on a host the member never signed in to leaves no token, useUserInfo resolves "no-session", and the client walks them to /logout and on to login.kamocrm.com — another company's sign-in page, while their own session is still perfectly valid. That would have happened on success too. Every redirect out of the callback now carries the org's own workspace host, derived from its domain rows rather than from a request header — a header is caller-supplied and would make each of these an open redirect. The two branches that fire before any org is knowable (no state, expired state) keep the configured default.