@insforge/react 1.1.7-dev.0 → 1.1.7

package/dist/index.cjs

@@ -565,10 +565,27 @@ var InsforgeManager = class _InsforgeManager {
     const state = this.getState();
     this.listeners.forEach((listener) => listener(state));
   }
+  /**
+   * Clean up sensitive auth parameters from URL
+   * This is needed because SDK's detectAuthCallback may not run in Next.js
+   * when the SDK client is created at module level (before hydration)
+   */
+  cleanUrlParams() {
+    if (typeof window === "undefined") return;
+    const params = new URLSearchParams(window.location.search);
+    const authParams = ["access_token", "user_id", "email", "name", "csrf_token", "error"];
+    const hasAuthParams = authParams.some((p) => params.has(p));
+    if (hasAuthParams) {
+      const url = new URL(window.location.href);
+      authParams.forEach((p) => url.searchParams.delete(p));
+      window.history.replaceState({}, document.title, url.toString());
+    }
+  }
   // Load auth state
   // Gets session and user data from getCurrentSession()
   // Called after hydration to restore authentication state
   async loadAuthState() {
+    this.cleanUrlParams();
     try {
       const {
         data: { session }