Public Access
laurensandClaude Opus 5.5
57d3d3c801
A token Spelunk's token endpoint returns must begin with spelunkapp_, the prefix Spelunk reads a bearer token as an app session's by; anything else is refused as an answer this app does not understand. Neither the sign-in's client nor the tunnel's follows redirects, so the code, its verifier and the token go to the address signed in to and nowhere else, and signing out sends the token only to an address that still normalises to itself, within ten seconds of its own. Opening the browser and waiting for it now always end in a SpelunkSignInException rather than whatever the platform threw: a browser that will not open, a phone's browser closed without an answer (the OidcException AndroidRedirectCallback.Abandon raises, which escaped the Security page and the editor before), another sign-in taking over the phone's redirect, and the ten-minute timeout are each said. A refused code says it in Spelunk's own words, and a rate limit says to wait. Tests: a refused code's detail, a non-app token, a browser that will not open, an abandoned phone sign-in, the timeout, the user cancelling, a phone redirect sent byte for byte both times, the real loopback listener on 127.0.0.1 taking one answer and closing, and a sign-out that will not send the token to an address it could not have come from. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>