A declared redirect-host allowlist that resolves empty means no restriction
Maintainers usually reply within 1 day
@heskew is already working on this.
Since Oct 1, 2026.
Assessment
This issue has not been assessed yet.
Description
A declared redirect-host allowlist that resolves to an empty list is treated as "no restriction" instead of failing closed.
normalizeMcpSecurityConfig (src/lib/config.ts) filters mcp.dynamicClientRegistration.allowedRedirectUriHosts and mcp.clientIdMetadataDocuments.allowedHosts down to non-empty entries. A declared value whose entries all resolve blank therefore normalizes to [], for example:
- an env placeholder that expands to
""(docker-composeX=${X}withXunset) - whitespace-only entries
validateRedirectUri (src/lib/mcp/clientValidator.ts) reads an empty or absent list as "no allowlist" (allowedHosts && allowedHosts.length > 0 && ...). So the operator declared a restriction and gets none. A declared CIMD allowedHosts that resolves empty has the same effect for interactive CIMD clients. The headless client_credentials path already refuses an empty list.
This is the same fail-open shape that #240 and #207 closed for initialAccessToken and the MCP feature booleans (HarperFast/oauth#247).
Fix: when MCP is enabled and the key is declared, but the list is empty after normalization, throw at startup naming the key. That matches the fail-closed handling of the other fields. Omitting the key keeps the documented "no allowlist" default. Raised in review of #247 and deliberately left out of it.
- Dominant language
- JavaScript
- Stars
- 1
- Forks
- 3
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 28
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from HarperFast/oauth
-
Open-issue triage and roadmap (post-2.9.0)Possibly taken @heskew claimed this 14 days ago. Open
HarperFast/oauth#278 · 1 assignee ·
Maintainers usually reply within 1 day
-
Session docs overstate expiry: no default lifetime, and invalidation clears fields rather than deleting the rowPossibly taken @heskew claimed this 14 days ago. Open
HarperFast/oauth#277 · 1 assignee ·
Maintainers usually reply within 1 day
-
Azure ?appid= form of the shared-alias keys URL isn't recognizedPossibly taken @heskew claimed this 14 days ago. Open
HarperFast/oauth#275 · 1 assignee ·
Maintainers usually reply within 1 day
-
Roleless OAuth session can inherit a role when a matching account is created laterPossibly taken @heskew claimed this 14 days ago. Open
HarperFast/oauth#273 · 1 assignee ·
Maintainers usually reply within 1 day
-
Azure multi-tenant: allow account adoption for an allowlist of tenants without restricting sign-inPossibly taken @heskew claimed this 14 days ago. Open
HarperFast/oauth#272 · 1 assignee ·
Maintainers usually reply within 1 day
All issues in HarperFast/oauth
Similar issues
-
[Website] Catalog: unknown sort value and mixed-case technology in the URL break the filtersPossibly taken @barbierajput378-pixel claimed this today. Openarea/website framework/jekyll help wanted language/css language/javascript language/markdown
Difficulty 2/5 1-3 hours Newbie friendliness 80/100
meshery/meshery.io#3088 · 1 comment ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
firecrawl/firecrawl-mcp-server#548 ·
Maintainers usually reply within 1 day
-
Area:WebGL p5.js 2.0+
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
processing/p5.js#9302 ·
Maintainers usually reply within 3 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
documentation good first issue hacktoberfest
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
wassim-azi/agy-powerline#47 ·
Maintainers usually reply within 1 day