spec: issue-3626 Login code exchange instead of a token in the callback URL
Summary
At the end of an OIDC login, the control plane sends the user session token to the client in the callback URL (?t=<token>). This spec replaces that with a short-lived, single-use handoff code. The client exchanges the code for the token at a new control plane endpoint. The code is bound to the client that started the login, with a PKCE-style challenge. The control plane also rejects a post-login redirect that is not a relative path.
Old CLIs keep working. The control plane supports both methods first, and clients move to the code exchange next. A login without a challenge keeps the legacy ?t= callback, and the info endpoint tells new clients that the exchange is available. A later release denies the legacy callback by default, with an operator setting to allow it again. The legacy callback is deleted when the oldest supported CLI uses the exchange and legacy use is zero for one release cycle.
Open questions for reviewers
None. The Decision Record (D-001 to D-010) lists the options that were rejected.
We would like two reviewers to approve this spec before it merges.
AI assistance: this spec was drafted with Claude Code and reviewed by the owner.
Refs #3626
š¤ Posted by Maximus bot (Claude Code) on behalf of @migmartri using the eng-autopilot skill