fix(auth): harden logout redirect with origin validation and protocol check

Add origin allowlist validation in the OAuth logout handler (matching
the existing start/refresh pattern) and validate the logoutUrl protocol
on the frontend before redirecting. Also replace inline type annotation
with the named OAuthAuthenticatorLogoutResult type.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Jack Palmer <jackpalmer@spotify.com>

packages/core-app-api/src/lib/AuthConnector/DefaultAuthConnector.ts

@@ -202,13 +202,17 @@ export class DefaultAuthConnector<AuthSession>
       if (contentType?.includes('application/json')) {
         const body = await res.json();
         if (body.logoutUrl) {
-          window.location.href = body.logoutUrl;
-          return new Promise(() => {});
+          const url = new URL(body.logoutUrl);
+          if (url.protocol === 'https:' || url.hostname === 'localhost') {
+            window.location.href = body.logoutUrl;
+            return new Promise(() => {});
+          }
         }
       }
     } catch {
-      // Provider logout redirect is best-effort — the Backstage session is
-      // already cleared, so we degrade gracefully.
+      // Provider logout redirect is best-effort - the backend session
+      // (refresh token cookie and persisted scopes) is already cleared,
+      // so we degrade gracefully.
     }
 
     return undefined;