Consider how to prevent "redirect" challenge from being abused.

[PieterKas]

The error=mfa_required, followed by challenge_type=redirect with some new context mechanism may be used by OAuth providers to switching to a web auth to show arbitrary prompts (like legal notices, notices of expiring billing information, etc.) In other words, they’ll use error=mfa_required/credential_required to show non-credential non-MFA prompts, contradictory to the error code.

Is there an alternative we can propose (e.g. claims challenge type flow)?