Return User Signature as a URL Fragment Instead of Query Parameter

[zavodil]

When invoking the signMessage function in Bitte Wallet, the user's signature is currently being returned in the URL as a query parameter. For example:

http://callbackUrl?signature=<signature>

Returning sensitive information like a user's signature in the URL query parameters introduces security concerns:

• Logging Risks: Query parameters are often logged by web servers, proxies, and even browsers, which could inadvertently expose sensitive information.
• History Storage: URLs with query parameters can be stored in the browser's history, further increasing the risk of unintentional leakage.

Proposed Solution: To mitigate these risks, it would be more secure to return the signature as a URL fragment (hash). For example:

http://callbackUrl#signature=<signature>