b2c-slas-auth-patterns

The code describes a legitimate session-bridging workflow and shows no clear malicious behavior. The examples nevertheless contain unvalidated redirect parameters, an unsafe substring-based host check, and URL exposure of bridge tokens. Validate redirect destinations and exact origins, and avoid query-string token transport where possible.