How do I verify auth redirect URLs are legitimate?

Auth redirects do not carry a signed header like webhooks do.

Auth redirects do not carry a signed header like webhooks do. Verify legitimacy by checking the user_id, reference_id and resource parameters in the redirect URL against the values from your original widget session request.

Best practice:

• Do the validation server-side.

• Store the expected redirect URLs when generating the session.

• Always use HTTPS redirect URLs.

See handling authentication events.