{#
Auth Callback Handler
Supabase redirects to this page after authentication.
We process the parameters in JavaScript because they are only present on the URL
hash, which prevents it from ever being leaked in logs and to proxies, but means
that it is not accessible by the server.
CSP is enforced as strictly as possible by passing a random nonce to the body and
via the `Content-Security-Policy` header that only allows the script inside this
template, as marked by the nonce, to run. No external scripts are allowed.
(Note that if there is ever a need to load external content into this page, the CSP
policies we have in place will need to be re-evaluated.)
`window.location.hash` must *always* be called when this page is loaded to prevent
sensitive data in the URL from being stored in the browser history.
We also set the `Referrer-Policy` header to `no-referrer` to prevent the
browser from sending the URL of this page to the next page, just in case.
Given these constraints, the only way to leak sensitive data is if the user
has a malicious browser extension that reads the URL and sends it to an attacker,
or if the user manually copies and pastes the URL.
#}
Logging in...