Resolves with the full callback URL the popup was redirected to, once the
callback page broadcasts it. Rejects after timeoutMs.
Attach this BEFORE the redirect can possibly happen (i.e. immediately after
opening the popup, with no await in between): BroadcastChannel does not
buffer, so a message posted before this subscribes is simply lost.
state is validated here only to route the message to the right waiter.
The authoritative CSRF check is still parseAuthorizationCallback, which
the caller runs on the returned URL.
Resolves with the full callback URL the popup was redirected to, once the callback page broadcasts it. Rejects after
timeoutMs.Attach this BEFORE the redirect can possibly happen (i.e. immediately after opening the popup, with no
awaitin between):BroadcastChanneldoes not buffer, so a message posted before this subscribes is simply lost.stateis validated here only to route the message to the right waiter. The authoritative CSRF check is stillparseAuthorizationCallback, which the caller runs on the returned URL.