Accept a bounded application-relative destination at the entry point and validate it against the same origin before beginning authentication.

Carry the validated destination through the email/password sign-in form and its authentication callback.

Apply the validated destination when the authenticated session becomes active, and preserve its supported query parameters.

Use a safe application default when the destination is absent or invalid.

Exercise the real email/password sign-in flow and assert the final browser URL and authenticated state; a provider fixture alone cannot establish this behavior.

Reject cross-origin destinations without widening credential scope; measure additional authentication entry points separately.