Function oauth_browser 

pub(crate) async fn oauth_browser(
    __arg0: State<AppState>,
    uri: Uri,
    query: Result<Query<OAuthBrowserQuery>, QueryRejection>,
    headers: HeaderMap,
) -> Response

GET /oauth/browser

With a ticket, spends it and signs this browser in as the account it was minted for, then answers 303 See Other to this page with crate::oauth::browser::COOKIE set. Without one, lists the accounts this browser is signed in as. See crate::oauth::browser.

Served on the issuer’s host alone (crate::oauth::discovery::issuer_for), so no cookie is set on an agent’s own host. A ticket is refused, and left as it was, when Sec-Fetch-Site says the link was followed from another site, so a link planted on another page cannot sign a browser in, and while the e-stop is engaged. The request span carries the path alone, so a ticket is never logged.

Every answer carries Cache-Control: no-store and the landing page’s content security policy.