remove auth params from url after login attempt (#25664)

src/vector/app.tsx

@@ -75,13 +75,17 @@ function makeRegistrationUrl(params: QueryDict): string {
 
 function onTokenLoginCompleted(): void {
  // if we did a token login, we're now left with the token, hs and is
- // url as query params in the url; a little nasty but let's redirect to
- // clear them.
+ // url as query params in the url;
+ // if we did an oidc authorization code flow login, we're left with the auth code and state
+ // as query params in the url;
+ // a little nasty but let's redirect to clear them.
  const url = new URL(window.location.href);
 
  url.searchParams.delete("loginToken");
+ url.searchParams.delete("state");
+ url.searchParams.delete("code");
 
- logger.log(`Redirecting to ${url.href} to drop loginToken from queryparams`);
+ logger.log(`Redirecting to ${url.href} to drop delegated authentication params from queryparams`);
  window.history.replaceState(null, "", url.href);
 }