1.25.3 — Trusted brand context for login handoffs

2026-09-13

Gated login handoffs consistently use the trusted destination brand for geofencing, login records and application callbacks, while preserving device attribution and the original request context.

Security

• Apply the trusted destination group's geofence policy before issuing a handoff token, including when the incoming request names another group.

Fixed

• Pass the trusted brand to login callbacks without changing their arguments or the successful token response.
• Preserve device attribution while keeping the original request and ambient request context unchanged.