Web developers who have previously ran an application on `http://localhost` that enabled HSTS (HTTP Strict Transport Security) will find themselves unable to authenticate because their browser (typically Safari, in practice) will keep redirecting them to `https://localhost`, which isn't handled by our local server. This switches the authorization callback to be to `127.0.0.1`, which should be equivalent to `localhost`, but not subject to HSTS. |
||
|---|---|---|
| .. | ||
| oauth.go | ||