Pull request (OPEN) · PR #1011 fix(endpoint-auth): refuse a repeated URL parameter or a client_id with dot segments · @rmdes
Fixes #1010
A URL parameter given more than once is refused as an invalid value, and so is a client_id with a . or .. path segment, checked on the raw value. Two tests, each failing (302 to the consent screen) before the change.