[management,proxy] Rename the OIDC session code query parameter (#7981)

proxy/internal/proxy/reverseproxy.go

@@ -725,9 +725,9 @@ func stripSessionCookie(r *httputil.ProxyRequest) {
 // from the outgoing URL to prevent credential leakage to backends.
 func stripSessionTokenQuery(r *httputil.ProxyRequest) {
 	q := r.Out.URL.Query()
-	if q.Has("session_token") || q.Has("session_code") {
-		q.Del("session_token")
-		q.Del("session_code")
+	if q.Has(auth.SessionTokenQueryParam) || q.Has(auth.SessionCodeQueryParam) {
+		q.Del(auth.SessionTokenQueryParam)
+		q.Del(auth.SessionCodeQueryParam)
 		r.Out.URL.RawQuery = q.Encode()
 	}
 }

proxy/internal/proxy/reverseproxy_test.go

@@ -236,6 +236,17 @@ func TestRewriteFunc_SessionTokenQueryStripping(t *testing.T) {
 			"other query parameters must be preserved")
 	})
 
+	t.Run("strips nb_session_code query parameter", func(t *testing.T) {
+		pr := newProxyRequest(t, "http://example.com/callback?nb_session_code=code123&other=keep", "1.2.3.4:5000")
+
+		rewrite(pr)
+
+		assert.Empty(t, pr.Out.URL.Query().Get("nb_session_code"),
+			"OIDC session code must be stripped from backend request")
+		assert.Equal(t, "keep", pr.Out.URL.Query().Get("other"),
+			"other query parameters must be preserved")
+	})
+
 	t.Run("preserves query when no session_token present", func(t *testing.T) {
 		pr := newProxyRequest(t, "http://example.com/api?foo=bar&baz=qux", "1.2.3.4:5000")