Logging into Lexbox from FwLite Web using credentials shows error

Describe the bug

[!NOTE]
This bug is not a blocker. The sign in works, it just shows an ugly error and doesn't redirect the user back to the app.

Logging into Lexbox from FwLite Web (not FwLite Maui) using credentials (not Google Sign In) results in this error:

To Reproduce

1. Log out of lexbox.org
2. Log out of Lexbox in FwLite Web
3. Login to Lexbox in FwLite Web
4. Use username/password to login to Lexbox

Expected behavior
The user should get redirected back to FwLite Web without an error

Initial triage

This is sort of related:

strict-origin-when-cross-origin (default)
Send the origin, path, and query string when performing a same-origin request. For cross-origin requests send the origin (only) when the protocol security level stays same (HTTPS→HTTPS). Don't send the Referer header to less secure destinations (HTTPS→HTTP).

I see the referrer header being lost in a redirect from HTTPS → HTTP.

But, I don't think there referrer is actually want we want to use here.
None of the requests to either the FwLite Web server or lexbox.org have the FwLite Web URL in them (as referrer or redirectUrl etc.) that we want to be redirected to at the end of the workflow.

The AI suggested fix is to not use referrer (partially due to the HTTPS → HTTP issue) and instead include a redirectUrl somehow e.g. in the oauth state.

Perhaps (including in the initial request to lexbox and/or FwLite Web) here?

Start by reproducing the four login steps in FwLite Web and trace the redirect flow between FwLite Web and lexbox.org, including the referrer and any redirectUrl or OAuth state. Done means credential login returns the user to FwLite Web without displaying the error.