* fix: resolve insecure OAuth redirect URI registration
Reject unsafe redirect URIs during dynamic OAuth client registration so only HTTPS and loopback HTTP callbacks are accepted. This prevents token/code exfiltration through attacker-controlled redirect targets while preserving local native client flows.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: normalize IPv6 loopback hosts in OAuth redirect validation
Strip bracketed IPv6 hosts before comparing against LOOPBACK_HOSTS so
http://[::1] callbacks are accepted as intended.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
17b8fe2409