Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

OAuth token exchange fails with URL-encoded responses - assumes JSON format only

Abierto Apto para principiantes
  • ¿Algo no está bien?
#759 4 comentarios 2 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
74/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Tranquilo
Stack tecnológico
typescript
Área
api, authentication

Línea de trabajo

Empieza en client/auth.js, en exchangeAuthorization(), donde el issue identifica la llamada directa a response.json(). Reproduce el intercambio contra el endpoint de tokens de GitHub si hay credenciales disponibles y, después, verifica el manejo tanto de respuestas JSON como de respuestas codificadas en URL. Se considera terminado cuando OAuthTokensSchema.parse se ejecuta correctamente para cualquiera de los dos formatos sin romper el manejo existente de errores HTTP.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

auth bug fix proposed P2 ready for work

** Describe the bug **
The exchangeAuthorization() function in client/auth.js assumes OAuth token responses are always in JSON format and calls response.json() directly. However, many OAuth providers (including GitHub) return token responses in URL-encoded format (application/x-www-form-urlencoded), causing token exchange to fail with a JSON parsing error.

** Steps to reproduce the behavior: **
Set up OAuth authentication with GitHub's MCP server (https://api.githubcopilot.com/mcp)
Register a GitHub OAuth app and configure pre-registered credentials
Complete the authorization flow successfully (Step 1 works fine)
Attempt token exchange in Step 2 of the OAuth flow
Observe JSON parsing error when GitHub returns URL-encoded token response

** Expected behavior **
The SDK should handle both common OAuth token response formats:
JSON format: {"access_token": "...", "token_type": "bearer", "scope": "..."}
URL-encoded format: access_token=...&token_type=bearer&scope=...
The token exchange should succeed regardless of which format the OAuth provider uses.

Logs

🔍 Token URL: https://github.com/login/oauth/access_token
🔍 Response Text: access_token=gho_oB*****************************&scope=gist%2Cnotifications%2Cpublic_repo&token_type=bearer

❌ SyntaxError: Unexpected token 'a', "access_tok"... is not valid JSON
    at JSON.parse (<anonymous>)
    at exchangeAuthorization (file://client/auth.js:335:41)

** Additional context **
OAuth Standards: Both response formats are valid according to OAuth 2.0/2.1 specifications. Different providers use different formats.
GitHub Behavior: GitHub's OAuth token endpoint returns URL-encoded responses by default, but does provide valid JSON when the new Accept request header is added. Not all oAuth servers will respect the Accept header though.

Current SDK Code (line ~325 in client/auth.js):

const response = await fetch(tokenUrl, {
       method: "POST",
       headers: {
           "Content-Type": "application/x-www-form-urlencoded",
       },
       body: params,
   });
   if (!response.ok) {
       throw new Error(`Token exchange failed: HTTP ${response.status}`);
   }
   return OAuthTokensSchema.parse(await response.json()); // ❌ Assumes JSON

** Suggested Fix **

const response = await fetch(tokenUrl, {
       method: "POST",
       headers: {
           "Content-Type": "application/x-www-form-urlencoded",
           "Accept": "application/json", // ✅ Request JSON response
       },
       body: params,
   });
   if (!response.ok) {
       throw new Error(`Token exchange failed: HTTP ${response.status}`);
   }
   
   // ✅ Handle both JSON and URL-encoded responses
   const responseText = await response.text();
   let tokenData;
   try {
       tokenData = JSON.parse(responseText);
   } catch (jsonError) {
       // Fallback to URL-encoded parsing
       const urlParams = new URLSearchParams(responseText);
       tokenData = {
           access_token: urlParams.get("access_token"),
           token_type: urlParams.get("token_type"),
           scope: urlParams.get("scope"),
           refresh_token: urlParams.get("refresh_token"),
           expires_in: urlParams.get("expires_in") ? parseInt(urlParams.get("expires_in")) : undefined,
       };
   }
   
   return OAuthTokensSchema.parse(tokenData);

This issue can be reproduced using GitHub's MCP server at https://api.githubcopilot.com/mcp with proper GitHub OAuth app credentials. NOTE: There is a related issue with GitHubs oAuth where by it does not expose it's oAuth info on .well-known/oauth-authorization-server, but rather returns a resource_metadata="https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp" param in the www-authenticate field (see #758)

** Impact **
This affects compatibility with any OAuth provider that returns URL-encoded token responses, making the SDK incompatible with a significant portion of OAuth servers.

Lenguaje dominante
TypeScript
Estrellas
13.4k
Forks
2.2k
Merge medio
5 d 3 h
PR fusionados (30 d)
4

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de modelcontextprotocol/typescript-sdk

Todos los issues de modelcontextprotocol/typescript-sdk

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.