What problem does it solve? Manus fullstack (web-db-user) projects deploy the frontend and backend on separate servers, so the backend cannot reliably determine the frontend's origin. Hardcoding domains or using req.host produces broken OAuth callbacks, invite links, and magic links, and a naive state parameter opens an OAuth login CSRF / session-fixation hole. ## Core Features & Use Cases - Origin-safe redirect URLs: Always derive callback and invite URLs from window.location.origin passed explicitly from the frontend, never from hardcoded domains or environment variables. - CSRF-protected OAuth flow: Bind the OAuth state parameter to the browser with a one-time nonce stored in a __Host- prefixed cookie, verified before exchanging the authorization code. - Invite and magic link generation: Pass the frontend origin through tRPC mutations so the backend can build correct invitation, email verification, and magic link URLs. - Use Case: When adding a login button or an event invitation feature to a Manus webdev project, use this Skill to wire the OAuth callback and invite URL generation correctly without introducing session-fixation vulnerabilities. ## Quick Start Ask the AI to implement the Manus OAuth login flow and invite link generation in your webdev project using window.location.origin and the nonce-based state cookie pattern.
