casdoor
diff --git a/‎docs/application/terminology.md‎
Lines changed: 2 additions & 2 deletions b/‎docs/application/terminology.md‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎docs/provider/notification/customHttp.md‎
Lines changed: 15 additions & 0 deletions b/‎docs/provider/notification/customHttp.md‎
Lines changed: 15 additions & 0 deletions
@@ -92,8 +92,8 @@ Each OAuth / Web3 / SAML provider entry in the provider table has additional per
 
 - **Org choice mode** — How users select their organization at sign-in: `None`, `Select` (dropdown), or `Input` (text field).
 - **Signin methods** — Ordered list of sign-in methods shown on the login page (e.g. Password, Verification code, WebAuthn).
-- **Signup HTML** — Custom HTML injected into the sign-up page.
-- **Signin HTML** — Custom HTML injected into the sign-in page.
+- **Signup HTML** — Custom HTML injected into the sign-up page. Embedded `<script>` tags are executed, so only use trusted content.
+- **Signin HTML** — Custom HTML injected into the sign-in page. Embedded `<script>` tags are executed, so only use trusted content.
 - **Page HTML** — Custom HTML injected into the page `<head>` (e.g. meta tags, analytics snippets, or custom styles/scripts) for all of the application's pages.
 - **Signin items** — Configure which fields and controls appear on the sign-in form.
 - **Signup items** — Configure the registration form fields (visible only when **Enable signup** is on).
 
@@ -26,3 +26,18 @@ When you use **Send Notification Message**, Casdoor sends a request to **Endpoin
 ![custom_http_request](/img/providers/notification/custom_http_request.png)
 
 <video src="/video/provider/notification/use_custom_http_as_notification_provider.mp4" controls="controls" width="100%"></video>
+
+## Recipient forwarding
+
+The `send-notification` API accepts an optional `recipient` field in its request body:
+
+```json
+{
+  "content": "Your message",
+  "recipient": "user@example.com"
+}
+```
+
+When a `recipient` is provided, the Custom HTTP provider forwards it to your **Endpoint** as an additional `recipient` request parameter — a query parameter for `GET`, or a form field for `POST` — alongside the message in your configured **Parameter name**. The `recipient` parameter is only sent when it is non-empty, so requests without a recipient are unchanged.
+
+Notification providers that do not support recipient-aware sending simply ignore the `recipient` value, so their behavior is unchanged.