Using https instead of nu.thalia as scheme for OAuth redirects is more secure, since both iOS and Android require a web server to declare that they some app is allowed to listen to its https redirects.
For #239, we have to do this as TOSTI doesn't allow non-https redirects, but for concrexit it also seems like a good idea.
Using
https
instead ofnu.thalia
as scheme for OAuth redirects is more secure, since both iOS and Android require a web server to declare that they some app is allowed to listen to its https redirects.For #239, we have to do this as TOSTI doesn't allow non-https redirects, but for concrexit it also seems like a good idea.
See https://developer.android.com/training/app-links/verify-site-associations