What problem does it solve? Fullstack apps deployed with separate frontend and backend servers cannot reliably determine the frontend origin on the backend, which breaks OAuth redirect URLs, invite links, and magic links. It also prevents OAuth login CSRF and session-fixation attacks caused by unvalidated callback state. ## Core Features & Use Cases - Origin-safe redirect URLs: Always derive callback and invite URLs from window.location.origin passed explicitly from the frontend, never from hardcoded domains or req.host. - CSRF-protected OAuth callback: Bind the OAuth state parameter to a one-time nonce stored in a __Host- cookie, verified before exchanging the authorization code. - Invite and magic link generation: Accept an origin field in tRPC mutations so backend-generated URLs point at the correct deployment. - Use Case: When adding Google-style login to a Manus fullstack app, use this guidance to wire the login button, callback route, and invite emails so redirects work across preview and production domains without session-fixation vulnerabilities. ## Quick Start Ask the AI to implement the Manus OAuth login flow in your fullstack app using window.location.origin for the redirect URI and the nonce cookie state validation from the template.
