Minor log-viewer gotcha (FYI)
One small thing that tripped me up while inspecting the logs:
In Admin → Logs → env → params, values may appear with escaped sequences such as:
\u0026
This is just JSON/Ruby escaping for &. For example:
error=access_denied\u0026error_subcode=cancel
should be read as:
error=access_denied&error_subcode=cancel
Nothing is being mangled or lost - it’s purely a display/serialization detail - but it’s worth knowing so operators don’t miss the underlying IdP signal when diagnosing csrf_detected failures.