OAuth callback exposes id_token in localhost URL query string

What version of the Codex App are you using (From “About Codex” dialog)?

Codex Desktop 26.608.12217

What subscription do you have?

ChatGPT Plus

What platform is your computer?

Windows 11

What issue are you seeing?

Title: OAuth callback exposes id_token in localhost URL query string

Environment:

• Codex Desktop 26.608.12217
• Windows 11

Problem:
During the remote connection authentication flow, the browser is redirected to a localhost callback URL that includes an id_token as a query parameter.

Example format:
http://localhost:1455/success?id_token=<token>

Concern:
Although the token may be short-lived, placing authentication tokens in URLs can result in exposure through:

• Browser history
• Screenshots
• Clipboard copies
• Browser sync systems
• Diagnostic logs
• Crash reports

Expected behaviour:
Authentication tokens should be transmitted via a mechanism that does not expose them in browser URLs.

Actual behaviour:
The id_token appears directly in the browser address bar and browser history.

What steps can reproduce the bug?

When an ssh session isn't live go to connections from settings and log into codex from the SSH config panel it then throws the login page up and as part of the process generates a new browser tab with the URL ocalhost:1455/success?id_token= <- then the full ID token and doesn't close the TAB it is just left

What is the expected behavior?

_No response_

Additional information

_No response_