Whether the auth code is handed back via a “Continue” interstitial (a user
gesture) rather than a direct redirect. True for private-use reverse-DNS app
schemes (RFC 8252, e.g. io.element.android), which Chrome will not
auto-follow, and for a native client’s https universal link, which iOS
opens into the app only on a user navigation, not a silent 3xx. Web https
and native http loopback redirect directly; a javascript: or data:
target is neither dotted nor https, so it stays an inert Location, never
a clickable link.